I have a requirement to log the default Windows logs using the universal forwarder to our main Splunk server, and then we have another application that needs to send logs to a different set of Splunk indexers.
I am pushing the applications to the UF host via a deployment server, however how do I specify that Application B use a different set of indexers?
I think I have a conflict in the outputs.conf when I have both Application A and Application B deployed to the UF host. The outputs.conf files are located in each of the /apps/ApplicationA/default and /apps/ApplicationB/default folders.
If I have just Application A or Application B pushed on their own, the required data is pushed to the correct Splunk indexer(s). Both installed at the same time ceases to send out anything.