Getting Data In

How do I setup TCP ROUTING when using an intermediate forwarder

pkeller
Contributor

I have some sourcetypes that I'd like to go to two indexing destinations.

Universal Forwarder: (inputs.conf)

[monitor:///path/to/logs]
index=myindex
sourcetype=mysourcetype
_TCP_ROUTING=oregon,sanDiego

Intermediate forwarder: (outputs.conf)

[tcpout]
defaultGroup=oregon

tcpout:oregon]
autoLB = true
autoLBFrequency = 30
server = portland1:7777,portland2:7777,portland3:7777

[tcpout:sanDiego]
autoLB = true
autoLBFrequency = 30
server = sd1:7777,sd2:7777,sd3:7777

The logs are going only to the default group (oregon), so I'm wondering now if I need to add forwarding instances on my intermediate forwarders ... so that one forwarding instance routes to oregon and the other to san diego ... thus I wouldn't have any tcp routing statements on the intermediate forwarder ...

I'm hoping that I'm making sense here ...

ie: (inputs.conf)

[monitor:///path/to/logs]
index=myindex
sourcetype=mysourcetype
_TCP_ROUTING=oregon_forwarders,sandiego_forwarders

then: (also on the UF) - outputs.conf

[tcpout]
defaultGroup=oregon_forwarders

tcpout:oregon_forwarders]
autoLB = true
autoLBFrequency = 30
server = forwarder1:7777,forwarder2:7777

[tcpout:sandiego_forwarders]
autoLB = true
autoLBFrequency = 30
server = forwarder1:7778,forwarder2:7778
1 Solution

theouhuios
Motivator

pkeller
Contributor

Thank you ... That's perfect.

0 Karma

theouhuios
Motivator

You want to index them at oregon? Or do you want oregon to just act as forwarder and push those logs to sanDiego?

I do this in our environment where I route prod server logs to dev environment through forwarders in the middle which have ports and fw rules open to dev. Not sure if this is same type of configuration that you are trying to achieve.

0 Karma

pkeller
Contributor

I want to index them at both locations ... mainly for testing purposes as we're experiencing a small amount of corruption, so I'm looking to see whether both sites experiencing the same corruption or whether it's something in the network.

Thanks very much.

0 Karma
Get Updates on the Splunk Community!

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...