Getting Data In

How to index locally all incoming data and forward all input data in heavy forwarder

sieutruc
Contributor

Hello,

I have one heavy forwarder that receives data from some forwarders. After that, it indexes all those data, but it forwards all its local input data to another indexer without locally indexing them. Can you suggest me how to achieve that ?
Is the configuration right in the heavy forwarder ?

outputs.conf

[tcpout]
defaultGroup = noforward
disabled=false

[indexAndForward]
index=true
selectiveIndexing=true

[tcpout:indexer01]
server=178.17.0.46:9997

inputs.conf

[script://./bin/vmstat.sh]
_TCP_ROUTING=indexer01

Do all incoming data be locally indexed in this heavy forwarder and without forwarding to indexer 01 ?

For ex:
indexer
forwarder
UF1 UF2 UF3
Data from UF1,2,3 sent to forwarder is locally indexed in forwarder without continuing forwarding to indexer. Data input from forwarder itself is sent to indexer.
That's my concerning question

Tags (1)
0 Karma

MarioM
Motivator

I donot see the _INDEX_AND_FORWARD_ROUTING attribute in your inputs.conf, have you tried:

[script://./bin/vmstat.sh]
_TCP_ROUTING=indexer01
_INDEX_AND_FORWARD_ROUTING=<any_string>

*** UPDATE ***

This should work for UF:

[splunktcp://9997]
_INDEX_AND_FORWARD_ROUTING=index_uf_local

sieutruc
Contributor

I don't want to index that input data,just only forward it to indexer, so i don't put _INDEX_AND_FORWARD_ROUTING attribute in.
I just only want all incoming data from other UFs to be locally indexed on this heavy forwarder without forwarding to other indexers.
How can i configure those incoming data ?

0 Karma

sieutruc
Contributor

I would like to use a Splunk instance that indexes incoming data and forwards all its own performance data to other indexer. It's suitable for my system. One thing more, if you have a question about my issue, i think it's better to place in comment frame.

0 Karma

dart
Splunk Employee
Splunk Employee

Why not just deploy a Universal Forwarder for the local data, and keep the configuration seperate?

0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...