Getting Data In

How can I route os data from one set of indexers to another set of indexers?

saurabh_ti
Engager

Hi,

We need to route os data from one set of indexers to another set of indexers,but while using the below settings all the data from our indexers are getting routed to other set of indexers (testServers).
=======Transforms.conf======

[fleet]
REGEX = .
DEST_KEY=_TCP_ROUTING
FORMAT=testServers

=======Props.conf======

[top]
TRANSFORMS-routing=fleet

[iostat]
TRANSFORMS-routing=fleet

[vmstat]
TRANSFORMS-routing=fleet

[interfaces]
TRANSFORMS-routing=fleet

[cpu]
TRANSFORMS-routing=fleet

[df]
TRANSFORMS-routing=fleet

[hardware]
TRANSFORMS-routing=fleet

[version]
TRANSFORMS-routing=fleet

=======Outputs.conf======

[tcpout:testServers]
server= testServer.com:9997

We are routing the os data coming from our universal forwarders, using heavy forwarders. But here we need to route the os data of our indexers to another set of indexers. The above settings is not working in this case.

Any help is appreciated.

Thanks

0 Karma

valiquet
Contributor

You need to add another set of server groups in outputs.conf
Put the test under [default].

Then in inputs.conf using _TCP_ROUTING you can select your other set of Indexeur

0 Karma
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...