How to forward an index to another Splunk instance (n00b)?

[gsfc_linux_dan]

I found this Index and Forward data into another splunk instance  and then found the current version of the referenced documentation:   Documentation - Splunk® Enterprise - Forwarding Data - Route and filter data , but I am still confused.

We have a requirement to push data to another Splunk instance, outside out immediate network.   On which node of the Splunk cluster can I do this from ?

[gcusello]

Hi @gsfc_linux_dan,

the configurations described in the referred pages are usually applied on Forwarders (Heavy and/or Universal) not on Indexers.

Ciao.

Giuseppe

[gsfc_linux_dan]

Thanks for pointing that out.  Please bear with this n00b 😎

The forwarder in the cluster is, of course, a heavy forwarder.  If we set it up to create the index in question, we should then be able to push it to our own indexers AND to the other folks that need the data.

Does that sound like "The Right Way" to do it ?

[gcusello · Accepted solution]

Hi @gsfc_linux_dan,

there's something not completely exact:

Forwarders aren't clustered, only Indexers or Search Heads, you could have more Heavy Forwarders to avoid Single Points of Failure but it isn't a cluster.

You don't need to creat an index on Forwarders, they only forward logs to Indexers.

Anyway, yes: following the instructions in the documentation (Filter and Route Data) you can create a fork to send data from your Heavy Forwarders both to your Indexers and the other Indexers.

I used this approach in many projects: it isn't a so rare configuration!

Ciao.

Giuseppe

[gsfc_linux_dan]

Many thanks for providing a few clues to this clueless n00b.

[gcusello]

Hi @gsfc_linux_dan,

if one answer solves your need, please accept one answer for the other people of Community or tell me how I can help you.

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉

[gsfc_linux_dan]

A few straggling details:

The single Forwarder is not clustered, just part of the group of nodes making up the whole Splunk instance.  My apologies for confusion.

I expect if we add a second Forwarder, we will have to duplicate the push configuration so that data going thru either Forwarder gets where it needs to go.

Thanks again.