Getting Data In

How to forward logs from one Splunk server to another Splunk server?

dhavamanis
Builder

Can you please tell us, how to forward the logs from one splunk server to another. because we are already receiving log from webservers and the same logs needs to transfer to customers splunk platform. Can you please provide the step by step configuration details to enable the forwarding at Splunk indexer end.

Example :

syslog format logs are coming and indexing into splunk indexer splunkindexer.xyz.com:80 and need to forward the same set of logs to splunkindexer.xyz1.com:9997 as well from splunkindexer.xyz.com:80

Update :

We want to forward the specific index data alone from one splunk indexer to another splunk farm. Can you please provide the sample outputs.conf entries with syslog format.

0 Karma

linu1988
Champion

Hello,
You can use the outputs.conf file to configure the forwarding. It will work as heavy forwarder.
But you need to specify the proper whitelist and blacklist parameters to forward correct set of indexed data. Also if you want to retain local copy you need to set up the index_forward mechanism. Please follow the documentation.

link texthttp://docs.splunk.com/Documentation/Splunk/6.1.3/admin/Outputsconf

Thanks,
L

0 Karma

dhavamanis
Builder

We want to forward the specific index data alone from one splunk indexer to another splunk farm. Can you please provide the sample outputs.conf entries with syslog format.

0 Karma
Get Updates on the Splunk Community!

Splunk Enterprise Security 8.0.2 Availability: On cloud and On-premise!

A few months ago, we released Splunk Enterprise Security 8.0 for our cloud customers. Today, we are excited to ...

Logs to Metrics

Logs and Metrics Logs are generally unstructured text or structured events emitted by applications and written ...

Developer Spotlight with Paul Stout

Welcome to our very first developer spotlight release series where we'll feature some awesome Splunk ...