- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
How to send event from UF to multiple Heavy Forwarders and different indexers
I have the following situation:
I have an universal forwarder that were sent logs to (HF1 and index=idx1)
Could you provide suggestions on how to configure this universal forwarder (UF) to send logs to both (HF1 and index=idx1) and (HF2 and index=idx2)?
Any insights or advice would be appreciated. Thank you.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
![gcusello gcusello](https://community.splunk.com/legacyfs/online/avatars/553812.jpg)
![SplunkTrust SplunkTrust](/html/@E48BE65924041B382F8C3220FF058B38/rank_icons/splunk-trust-16.png)
Hi @randqm,
let me understand: do you want to send different logs to the two HFs or the same?
if the same, you have to configure the outputs.conf on the UF lke the following:
in outputs.conf:
[tcpout]
defaultGroup=HF1
[tcpout:HF1]
server=<ip_hf1>:9997
[tcpout:HF2]
server=<ip_hf2>:9997
in props.conf:
[default]
TRANSFORMS-routing=HF1
[syslog]
TRANSFORMS-routing=HF2
in transforms.conf
[HF1]
REGEX=.
DEST_KEY=_TCP_ROUTING
FORMAT=HF1
[HF2]
REGEX=.
DEST_KEY=_TCP_ROUTING
FORMAT=HF2
you can find more information at https://docs.splunk.com/Documentation/Splunk/9.0.4/Forwarding/Routeandfilterdatad
if you have to send different sets of data, you have to change the regexes in transforms.conf to filter data to send to HFs.
Ciao.
Giuseppe
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
![SplunkTrust SplunkTrust](/html/@E48BE65924041B382F8C3220FF058B38/rank_icons/splunk-trust-16.png)
Remember that UFs don't do transforms unless you force_local_processing.
So it's better to set _TCP_ROUTING directly at input level.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
![SplunkTrust SplunkTrust](/html/@E48BE65924041B382F8C3220FF058B38/rank_icons/splunk-trust-16.png)
outputs.conf should be set as in @gcusello 's example but instead of props.conf and transforms.conf entries you just add
_TCP_ROUTING = HF1
or
_TCP_ROUTING = HF2
into input.conf stanzas depending on which output you want to point each data stream to.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
How can I configure to send to different indexers
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks for the response
Do you can give me an example for the confs files?
![](/skins/images/53C7C94B4DD15F7CACC6D77B9B4D55BF/responsive_peak/images/icon_anonymous_message.png)