How to move internal logs from Deployment Server _internal db to Index Server _internal db?

[santiagoaloi]

Hello,

I'm having a hard time finding a way forwarding all the internal logs from my Deployment server to the Index server.
My idea is to actually move from _internal > _internal instead of _internal > main index. This is basically to consolidate the license usage logs in just one server, since my deployment server is my license master.

This is how my inputs.conf file looks like:

[monitor://$SPLUNK_HOME/var/log/splunk]
_TCP_ROUTING=indexserver
[monitor://$SPLUNK_HOME/etc/splunk.version]
_TCP_ROUTING=indexserver

This is how my outputs.conf file looks like:

[tcpout]
forwardedindex.0.whitelist = _internal
forwardedindex.1.whitelist = _audit
forwardedindex.filter.disable = false
indexAndForward = false
defaultGroup = indexserver
[tcpout:indexserver]
server = 10.10.10.10:9997
compressed = true
autoLB = true
[tcpout-server://10.10.10.10:9997]
sslCertPath = $SPLUNK_HOME/etc/auth/server.pem
sslRootCAPath = $SPLUNK_HOME/etc/auth/cacert.pem
sslVerifyServerCert = false
sslPassword = password

Thanks for the help,

//Santiago Aloi Deheza

[santiagoaloi · Accepted solution]

Just wanted to clarify that the inputs and outputs above are correct and that it works.

It takes one day till you can actually see the rollover summary.

index=_internal source=*license_usage.log type="RolloverSummary" earliest=-30d@d

| eval _time=_time - 43200
| bin _time span=1d
| stats latest(b) AS b by slave, pool, _time
| timechart span=1d sum(b) AS volume fixedrange=false
| foreach * [eval =round(''/1024/1024/1024, 3)]