Getting Data In

Heavy Forwader data route between multiple indexer

Communicator

Hi!

I know there are several questions in this topic, but I didn't find a solution for me.
I try to create a simple lab splunk system with 1 HF and 2 indexers (ix1, ix2). HF has 2 input udp://1514 and udp://1515.

I tried to forward udp://1514 to ix1 and udp://1515 to ix2 with no luck. Somehow both indexers receives both logs:(

inputs.conf

[udp://1514]
connection_host = ip
sourcetype = syslog

[udp://1515]
connection_host = ip
sourcetype = syslog

props.conf

[source::udp://1514]
TRANSFORMS-ix1 = send_to_ix1

[source::udp://1515]
TRANSFORMS-ix2 = send_to_ix2

transform.conf

[send_to_ix1]
REGEX = .
DEST_KEY = _TCP_ROUTING
FORMAT = indexer_1

[send_to_ix2]
REGEX = .
DEST_KEY = _TCP_ROUTING
FORMAT = indexer_2

output.conf

[tcpout:indexer_1]
server = 192.168.10.220:9997

[tcpout:indexer_2]
server = 192.168.10.221:9997

What am I doing wrong, please help me.
The final goal is to filter the logs received by indexers and send everything to a 3rd party log collector.

Thank your for your time,
Steven

0 Karma
1 Solution

Influencer

You don't need transforms to route data to specific indexer group. All you need to do is specify _TCP_ROUTING in your inputs like below

[udp://1514]
connection_host = ip
sourcetype = syslog
_TCP_ROUTING = indexer_1

[udp://1515]
connection_host = ip
sourcetype = syslog
_TCP_ROUTING = indexer_2

https://docs.splunk.com/Documentation/Splunk/6.5.2/Admin/Inputsconf

View solution in original post

0 Karma

Influencer

You don't need transforms to route data to specific indexer group. All you need to do is specify _TCP_ROUTING in your inputs like below

[udp://1514]
connection_host = ip
sourcetype = syslog
_TCP_ROUTING = indexer_1

[udp://1515]
connection_host = ip
sourcetype = syslog
_TCP_ROUTING = indexer_2

https://docs.splunk.com/Documentation/Splunk/6.5.2/Admin/Inputsconf

View solution in original post

0 Karma

Communicator

Thank you, it looks good.

But in the near future, I'll have to use REGEX for log filtering. Maybe can you explain why my solution isn't working?
Here is two page, I tried to solve the porblem based on these links?
https://wiki.splunk.com/Community:Test:How_Splunk_behaves_when_receiving_or_forwarding_udp_data
http://docs.splunk.com/Documentation/Splunk/6.5.2/Forwarding/Forwarddatatothird-partysystemsd

Regards,
Steven

0 Karma

Communicator

Finally, I found the problem. I made a typo in the transforms.conf file name. btool helps me to find the error.

State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!