Dual Forwarder Configuration

[MrWhoztheBoss]

Hi Everyone,

I am trying to figure out how can I do dual forwarder configuration for universal forwarders. Can someone please guide me in getting some idea for it or point out to splunk-docs/articles that can be helpful.

[gcusello]

Hi @MrWhoztheBoss,

what do you mean with "dual forwarder configuration for universal forwarders"?

You can have many configuration files in the deployed apps but for each parameter you can have only one value.

If instead you want to configure your UF to send logs to two indexers there are many answers to do this.

Ciao.

Giuseppe

[MrWhoztheBoss]

Hi @gcusello 

I was looking for how I can configure One UF to send data to Two Indexer Groups which are setup in different environment.

[gcusello · Accepted solution]

Hi @MrWhoztheBoss,

if you want to send the all the logs to two groups of indexers, you have to configure this situation in outputs.conf, something like this:

[tcpout:Group1]
server=server11:9997,server12:9997
disabled=false

[tcpout:Group2]
server=server21:9997,server22:9997
disabled=false

If instead you want to send only a part of logs to each group of indexers, you have to follow the instructions at https://docs.splunk.com/Documentation/Splunk/8.2.3/Forwarding/Routeandfilterdatad#Filter_and_route_e...

Ciao.

Giuseppe