Getting Data In

Can you send different logs to different Indexers from the same forwarder?

zbumpers
New Member

I would like to be able to send Log A to Indexer A and Log B to Indexer B from one forwarder.

0 Karma

vincenteous
Communicator

Hi zbumpers,

From my experience, it is possible to achieve this. You just need to set the proper indexer destination in outputs.conf of the forwarder. Create tcpout groups and then specify the groups to the proper monitoring stanza in inputs.conf. For example, something like this:

Your indexers: 192.168.56.101:8089 and 192.168.56.102:8089

In your forwarder:
outputs.conf:

[tcpout:IndexerA]
server=192.168.56.101:8089
....
....

[tcpout:IndexerB]
server=192.168.56.102:8089
....
....

inputs.conf:

[monitor:///path/to/log/A/logA.log]
# Add attributes to your monitor like sourcetype, index, etc
....
....
# In the end, specify to which indexer this log should be sent using _TCP_ROUTING = <group name>
_TCP_ROUTING = IndexerA

# Do the same for log B
[monitor:///path/to/log/B/logB.log]
....
....
_TCP_ROUTING = IndexerB

Restart the forwarder and see the result. Hope this helps.

References:
http://docs.splunk.com/Documentation/Splunk/6.2.1/admin/inputsconf
http://docs.splunk.com/Documentation/Splunk/6.2.1/admin/Outputsconf
http://docs.splunk.com/Documentation/Splunk/6.2.1/Forwarding/Configureforwarderswithoutputs.confd

Get Updates on the Splunk Community!

New Cloud Intrusion Detection System Add-on for Splunk

In July 2022 Splunk released the Cloud IDS add-on which expanded Splunk capabilities in security and data ...

Happy CX Day to our Community Superheroes!

Happy 10th Birthday CX Day!What is CX Day? It’s a global celebration recognizing innovation and success in the ...

Check out This Month’s Brand new Splunk Lantern Articles

Splunk Lantern is a customer success center providing advice from Splunk experts on valuable data insights, ...