Getting Data In

Forward data to two different indexers and filter a field out

klim
Path Finder

I need to forward data from a heavy forwarder to two different indexer clusters. One of the clusters needs to have a field removed. If I use sedcmd in props.conf on the HF it removes it for both and putting sedcmd in props.conf on one of the indexers doesn't work (it does work if i bypass the HF). 

Is there a way to do this?

Edit: I was thinking of using an intermediate forwarder so heavy forwarder -> another heavy forwarder -> indexer cluster but the intermediate heavy forwarder props.conf does not work.

Labels (1)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

What is it with the latest peak of question about "sending the data into two indexer(s| clusters) while modifying one stream"? Suddenly everyone has this borderline use case?

Why do that in the first place? Is it really worth paying extra for double the license? What actually is your use case?

0 Karma

PaulPanther
Motivator

Try to set 

sendCookedData=false

for the second HF output in your outputs.conf and then apply your props.conf on your second HF. 

 

0 Karma

PickleRick
SplunkTrust
SplunkTrust

This will actually send raw data suitable to further processing by third party solution. It will not keep the metadata, it will not use s2s protocol, just send "TCP syslog" stream.

 

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

A Four-Part Event Series: Full Stack Observability For the AI Era

As AI reshapes applications, infrastructure, and the way teams operate, the traditional boundaries of ...

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

The new SOC4Kafka connector, built on OpenTelemetry, enables the collection of Kafka messages and forwards ...

Event Series: Level up your SOC: Advancing with Splunk Enterprise Security

AI has fundamentally raised the stakes for security operations, and this three-part series is your guide to ...