Heavy Forwader data route between multiple indexer

[ikulcsar]

Hi!

I know there are several questions in this topic, but I didn't find a solution for me.
I try to create a simple lab splunk system with 1 HF and 2 indexers (ix1, ix2). HF has 2 input udp://1514 and udp://1515.

I tried to forward udp://1514 to ix1 and udp://1515 to ix2 with no luck. Somehow both indexers receives both logs:(

inputs.conf

[udp://1514]
connection_host = ip
sourcetype = syslog

[udp://1515]
connection_host = ip
sourcetype = syslog

props.conf

[source::udp://1514]
TRANSFORMS-ix1 = send_to_ix1

[source::udp://1515]
TRANSFORMS-ix2 = send_to_ix2

transform.conf

[send_to_ix1]
REGEX = .
DEST_KEY = _TCP_ROUTING
FORMAT = indexer_1

[send_to_ix2]
REGEX = .
DEST_KEY = _TCP_ROUTING
FORMAT = indexer_2

output.conf

[tcpout:indexer_1]
server = 192.168.10.220:9997

[tcpout:indexer_2]
server = 192.168.10.221:9997

What am I doing wrong, please help me.
The final goal is to filter the logs received by indexers and send everything to a 3rd party log collector.

Thank your for your time,
Steven

[pradeepkumarg · Accepted solution]

You don't need transforms to route data to specific indexer group. All you need to do is specify _TCP_ROUTING in your inputs like below

[udp://1514]
connection_host = ip
sourcetype = syslog
_TCP_ROUTING = indexer_1

[udp://1515]
connection_host = ip
sourcetype = syslog
_TCP_ROUTING = indexer_2

https://docs.splunk.com/Documentation/Splunk/6.5.2/Admin/Inputsconf

[ikulcsar]

Thank you, it looks good.

But in the near future, I'll have to use REGEX for log filtering. Maybe can you explain why my solution isn't working?
Here is two page, I tried to solve the porblem based on these links?
https://wiki.splunk.com/Community:Test:How_Splunk_behaves_when_receiving_or_forwarding_udp_data
http://docs.splunk.com/Documentation/Splunk/6.5.2/Forwarding/Forwarddatatothird-partysystemsd

Regards,
Steven

[ikulcsar]

Finally, I found the problem. I made a typo in the transforms.conf file name. btool helps me to find the error.