Getting Data In

Dual Forwarder Configuration

MrWhoztheBoss
Explorer

Hi Everyone,

I am trying to figure out how can I do dual forwarder configuration for universal forwarders. Can someone please guide me in getting some idea for it or point out to splunk-docs/articles that can be helpful.

Labels (2)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @MrWhoztheBoss,

if you want to send the all the logs to two groups of indexers, you have to configure this situation in outputs.conf, something like this:

[tcpout:Group1]
server=server11:9997,server12:9997
disabled=false

[tcpout:Group2]
server=server21:9997,server22:9997
disabled=false

If instead you want to send only a part of logs to each group of indexers, you have to follow the instructions at https://docs.splunk.com/Documentation/Splunk/8.2.3/Forwarding/Routeandfilterdatad#Filter_and_route_e...

Ciao.

Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @MrWhoztheBoss,

what do you mean with "dual forwarder configuration for universal forwarders"?

You can have many configuration files in the deployed apps but for each parameter you can have only one value.

If instead you want to configure your UF to send logs to two indexers there are many answers to do this.

Ciao.

Giuseppe

0 Karma

MrWhoztheBoss
Explorer

Hi @gcusello 

I was looking for how I can configure One UF to send data to Two Indexer Groups which are setup in different environment.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @MrWhoztheBoss,

if you want to send the all the logs to two groups of indexers, you have to configure this situation in outputs.conf, something like this:

[tcpout:Group1]
server=server11:9997,server12:9997
disabled=false

[tcpout:Group2]
server=server21:9997,server22:9997
disabled=false

If instead you want to send only a part of logs to each group of indexers, you have to follow the instructions at https://docs.splunk.com/Documentation/Splunk/8.2.3/Forwarding/Routeandfilterdatad#Filter_and_route_e...

Ciao.

Giuseppe

Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...