Getting Data In

Heavy Forwader data route between multiple indexer

ikulcsar
Communicator

Hi!

I know there are several questions in this topic, but I didn't find a solution for me.
I try to create a simple lab splunk system with 1 HF and 2 indexers (ix1, ix2). HF has 2 input udp://1514 and udp://1515.

I tried to forward udp://1514 to ix1 and udp://1515 to ix2 with no luck. Somehow both indexers receives both logs:(

inputs.conf

[udp://1514]
connection_host = ip
sourcetype = syslog

[udp://1515]
connection_host = ip
sourcetype = syslog

props.conf

[source::udp://1514]
TRANSFORMS-ix1 = send_to_ix1

[source::udp://1515]
TRANSFORMS-ix2 = send_to_ix2

transform.conf

[send_to_ix1]
REGEX = .
DEST_KEY = _TCP_ROUTING
FORMAT = indexer_1

[send_to_ix2]
REGEX = .
DEST_KEY = _TCP_ROUTING
FORMAT = indexer_2

output.conf

[tcpout:indexer_1]
server = 192.168.10.220:9997

[tcpout:indexer_2]
server = 192.168.10.221:9997

What am I doing wrong, please help me.
The final goal is to filter the logs received by indexers and send everything to a 3rd party log collector.

Thank your for your time,
Steven

0 Karma
1 Solution

pradeepkumarg
Influencer

You don't need transforms to route data to specific indexer group. All you need to do is specify _TCP_ROUTING in your inputs like below

[udp://1514]
connection_host = ip
sourcetype = syslog
_TCP_ROUTING = indexer_1

[udp://1515]
connection_host = ip
sourcetype = syslog
_TCP_ROUTING = indexer_2

https://docs.splunk.com/Documentation/Splunk/6.5.2/Admin/Inputsconf

View solution in original post

0 Karma

pradeepkumarg
Influencer

You don't need transforms to route data to specific indexer group. All you need to do is specify _TCP_ROUTING in your inputs like below

[udp://1514]
connection_host = ip
sourcetype = syslog
_TCP_ROUTING = indexer_1

[udp://1515]
connection_host = ip
sourcetype = syslog
_TCP_ROUTING = indexer_2

https://docs.splunk.com/Documentation/Splunk/6.5.2/Admin/Inputsconf

0 Karma

ikulcsar
Communicator

Thank you, it looks good.

But in the near future, I'll have to use REGEX for log filtering. Maybe can you explain why my solution isn't working?
Here is two page, I tried to solve the porblem based on these links?
https://wiki.splunk.com/Community:Test:How_Splunk_behaves_when_receiving_or_forwarding_udp_data
http://docs.splunk.com/Documentation/Splunk/6.5.2/Forwarding/Forwarddatatothird-partysystemsd

Regards,
Steven

0 Karma

ikulcsar
Communicator

Finally, I found the problem. I made a typo in the transforms.conf file name. btool helps me to find the error.

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...