Getting Data In

Heavy Forwader data route between multiple indexer

ikulcsar
Communicator

Hi!

I know there are several questions in this topic, but I didn't find a solution for me.
I try to create a simple lab splunk system with 1 HF and 2 indexers (ix1, ix2). HF has 2 input udp://1514 and udp://1515.

I tried to forward udp://1514 to ix1 and udp://1515 to ix2 with no luck. Somehow both indexers receives both logs:(

inputs.conf

[udp://1514]
connection_host = ip
sourcetype = syslog

[udp://1515]
connection_host = ip
sourcetype = syslog

props.conf

[source::udp://1514]
TRANSFORMS-ix1 = send_to_ix1

[source::udp://1515]
TRANSFORMS-ix2 = send_to_ix2

transform.conf

[send_to_ix1]
REGEX = .
DEST_KEY = _TCP_ROUTING
FORMAT = indexer_1

[send_to_ix2]
REGEX = .
DEST_KEY = _TCP_ROUTING
FORMAT = indexer_2

output.conf

[tcpout:indexer_1]
server = 192.168.10.220:9997

[tcpout:indexer_2]
server = 192.168.10.221:9997

What am I doing wrong, please help me.
The final goal is to filter the logs received by indexers and send everything to a 3rd party log collector.

Thank your for your time,
Steven

0 Karma
1 Solution

pradeepkumarg
Influencer

You don't need transforms to route data to specific indexer group. All you need to do is specify _TCP_ROUTING in your inputs like below

[udp://1514]
connection_host = ip
sourcetype = syslog
_TCP_ROUTING = indexer_1

[udp://1515]
connection_host = ip
sourcetype = syslog
_TCP_ROUTING = indexer_2

https://docs.splunk.com/Documentation/Splunk/6.5.2/Admin/Inputsconf

View solution in original post

0 Karma

pradeepkumarg
Influencer

You don't need transforms to route data to specific indexer group. All you need to do is specify _TCP_ROUTING in your inputs like below

[udp://1514]
connection_host = ip
sourcetype = syslog
_TCP_ROUTING = indexer_1

[udp://1515]
connection_host = ip
sourcetype = syslog
_TCP_ROUTING = indexer_2

https://docs.splunk.com/Documentation/Splunk/6.5.2/Admin/Inputsconf

0 Karma

ikulcsar
Communicator

Thank you, it looks good.

But in the near future, I'll have to use REGEX for log filtering. Maybe can you explain why my solution isn't working?
Here is two page, I tried to solve the porblem based on these links?
https://wiki.splunk.com/Community:Test:How_Splunk_behaves_when_receiving_or_forwarding_udp_data
http://docs.splunk.com/Documentation/Splunk/6.5.2/Forwarding/Forwarddatatothird-partysystemsd

Regards,
Steven

0 Karma

ikulcsar
Communicator

Finally, I found the problem. I made a typo in the transforms.conf file name. btool helps me to find the error.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...