Does Splunk Universal Forwarder support multiple Destinations or is the paid version required?

[FGo]

Dear Splunk team,

regarding the mentioned blog entry -- does the UF support sending to multiple destinations ("Data Cloning") or is the paid version -- HF -- required?

Thanks in advance for your effort,

Frank

[gcusello]

Hi @FGo,

at first HF isn't a paid version: in Splunk you pay only for indexed logs, if you don't index, but you only forward logs, you don't pay anythig!

Then, in the outputs.conf of your Universal Forwarder, you can configure two or more destinations:

if you want to duplicate all logs, try in outputs.conf:

[tcpout:Group1]
server=x.x.x.x:9997
[tcpout:Group2]
server=y.y.y.y:9997

If instead you want to send only a part of logs, follow the instructions at https://docs.splunk.com/Documentation/Splunk/9.0.4/Forwarding/Routeandfilterdatad#Filter_and_route_e....

Ciao.

Giuseppe

[richgalloway · Accepted solution]

What is the blog entry of which you speak?

One does not have to pay for an HF.  The software is free to use.  You pay only for the data you store in Splunk (ingestion model) or the resources you use to process stored data (workload model).

To answer the question, yes, a UF can clone data to multiple destinations - provided all of the destinations are Splunk instances.   Sending data to a syslog destination requires an HF.