Getting Data In

How to configure a universal forwarder to clone data to two different indexes?

echalex
Builder

Hello,

We have a setup where we share some data with our partner, so we have set up two different groups in outputs.conf, call them ourGroup and theirGroup. Then in inputs.conf, we set the _TCP_ROUTING to send to both groups. So far, so good.

Now it transpires that our partner would prefer a different naming convention for the index. I've looked at props.conf and transforms.conf, but it doesn't seem possible to change the index name, based on the tcpout-group. I'm not even sure if this is available on the UF.

So option 1 is to have multiple stanzas in inputs.conf for each source, with a different _TCP_ROUTING in each stanza. So, will there be a performance hit on the host with the UF installed? Especially interested in the Windows event log facility and how this would cope with several input stanzas.

Option 2, I guess, is to implement this in the receiving indexers. Whether I want to do this, I'm not completely sure. It would probably have to be our indexers. Our partner would have to implement several stanzas in props.conf, based on the host.

0 Karma
1 Solution

gfuente
Motivator

Hello

Option 1 won't work, you can't have multiple inputs to the same path, it will use only one of them.

The second option is the right one, leave the input without index configuration. And in the indexers use transforms to modify the index dynamically based on the sourcetype. See:

http://answers.splunk.com/answers/8531/routing-to-index-based-on-host-etc.html

Regards

View solution in original post

gfuente
Motivator

Hello

Option 1 won't work, you can't have multiple inputs to the same path, it will use only one of them.

The second option is the right one, leave the input without index configuration. And in the indexers use transforms to modify the index dynamically based on the sourcetype. See:

http://answers.splunk.com/answers/8531/routing-to-index-based-on-host-etc.html

Regards

echalex
Builder

Thanks! I guessed as much. An additional implied, but not articulated, question was: is there any way of doing this on the Universal Forwarder (using single stanzas)?

Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...