Getting Data In

Forwarding between multiple forwarders then to indexer

ramsanga
Explorer

My Splunk architecture is like this

I have three data centers (DC) and one each heavy forwarder in them .In each DC all the servers are forwarding the logs to heavy forwarder of the same DC via universal forwarders

I also have existing spunk set up in distributed architecture with two heavy forwarders two indexer and two search head.
Only heavy forwarders are routable in our environment and receives logs from infrastructure devices and then sending further to indexers in LB mode.

So, i would like to know if we can forward logs from heavy forwarder in each DC to this existing routable heavy forwarder then further to indexer I have read few answers regarding UF sending logs to intermediate forrwarder and then further to indexers. but could not find any specific answers on documentation on forwarding log between two or multiple heavy forwarders.

Many thanks in advance...

Tags (1)
0 Karma

ramsanga
Explorer

Thanks .

Can we send unparsed logs from each DC to routable heavy forwarders. I wanted to route logs from each DC to specific indexes dedicated for these DC. Which is the best place to configure logs routing DC indexes or routable indexes. At the moment all infrastructure logs routing is done in routable forwarder. I will appreciate if you can help with sample configuration.

0 Karma

yannK
Splunk Employee
Splunk Employee

Yes you can.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...