How to configure a universal forwarder to send data coming from certain applications to specific indexes?

[ramanapvr]

Dear All,

I have a question on Splunk Universal Forwarder.

Requirement: We have certain unique application servers where they would be sending data to the universal forwarder on port 9997. However, once the data comes to the universal forwarder, the data should be sent to two Splunk Indexer machines on different ports and to specific indexes created. So the data coming from application1, application2, application3 servers as example should go and reside on Splunk Indexers machines to their specified Indexes. Here the universal forwarder would be acting as a proxy I can say.

Can anyone please let me know how this could be possible? I would appreciate if proper pointers with examples are provided. Thanks much all.

Thanks and Regards,
Peri

[jkat54]

You'll need a combination of _TCP_ROUTING settings in your inputs.conf and the corresponding server/tcp out stanzas in your outputs.conf

Inputs:

[monitor:///opt/app1/logs/*.log]
_TCP_ROUTING=indexer1
index=indexName
sourcetype=app1log

Outputs:

[tcpout:indexer1]
server=10.0.0.1