Can single forwarder forward data to two different indexer's ??

[rakesh_498115]

Hi

I am using a UF say in Machine A , its has logs at two different paths say Log Path1 and Log Path2 . Now i want this Forwarder to forward LogPath1 data to one indexer say "C" and LogPath2 data to other indexer say "D" and i dont want LogPath1 data to be present in "D" Machine and viceversa.

Is this scenario possible ?? pls help.

[agup006]

You can also use Fluentd Enterprise to bifurcate data to separate indexers. You can use message content, message type, hostname, etc. to route the messages between the indexers. https://fluentd.treasuredata.com/splunk-optimize

[MartinMcNutt]

Watch out...This would be a double hit against your license.

Splunk needs to improve their DR/clustering to give better control over sending data to Hot spares or DR boxes without a double his on license.

[jmeyers_splunk]

I realize this comment is pretty old, but I wanted to supply an update to anybody who ends up here...

Indexer Clustering (http://docs.splunk.com/Documentation/Splunk/latest/Indexer/Aboutclusters) seems to take care of your needs around license consumption. It will replicate data in the background without incurring any additional splunk ingest.

[rakesh_498115]

Can i forward data from single UF to 2 different indexers. same data in 2 different index groups. ?? is this possible.?

[acharlieh]

yes, you configure outputs.conf as described in the docs

[chris]

If you specify the _TCP_ROUTING for every input, this setup will not index your data twice and will therefore not count twice towards your license.

[Ayn]

iirc there at least used to be HA licenses that you could use for indexing on multiple indexers without having to pay double the license costs.

[chris · Accepted solution]

Hi yes this is possible, you have to define 2 groups in outputs.conf and specify which input (log path) you want to send to which group Link to routing documentation

outputs.conf

[tcpout:c]
server=server1:9997

[tcpout:d]
server=server2:9997

inputs.conf

[monitor://path/file1.log]
_TCP_ROUTING = c

[monitor://path/file2.log]
_TCP_ROUTING = d

[rakesh_498115]

Thanks Chris 🙂