Getting Data In

How to forward log files to two different servers?

a212830
Champion

Hi,

I need to send some logfiles twice - send one set to my prod system, and another to a dev system. I have two different inputs/outputs in their own apps to handle the processing. Will Splunk do this, or will it determine that the logfiles are already being processed and only read them once?

0 Karma

rmorlen
Splunk Employee
Splunk Employee

You could setup two instances of the splunk forwarder on the same box. One sends to prod, one sends to dev.

If you want all the logs to go to both you could also setup index and forward on the indexers and forward the data.

0 Karma

yannK
Splunk Employee
Splunk Employee

2 forwarders is the easy method. very reliable.

The complex one is :
in outputs.conf : to define 2 tcpout groups,
in inputs.conf : create symlinks to the file, add an extra monitor on the symlink, add crcSALT to avoid conflict.
then and use _TCP_ROUTING rules on inputs.conf
the risk is that if one group is blocked, both will be blocked.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...