Getting Data In

How to send specific sourcetypes to multiple indexers

Jarohnimo
Builder

Hello,

I work in a department where there's multiple independent instances of splunk setup. We have need to send specific sourcetypes to multiple indexers. I understand this will be a double hit on our individual licenses that's why we want to limit the duplicate ingestion to only specific sourcetypes.

So sourcetypes abc will be sent to indexer1 and indexer2. Indexer1 and indexer2 are in totally different environments (separate licenses).

I'm assuming this can be accomplished on the universal forwarder by using multiple target groups and modifying the inputs.conf files of the sourcetypes I need duplicated with tcp routing?

Please let me know if this is the best way to do this or is there a better approach

1 Solution

wmyersas
Builder

Not exactly an answer, but is it not possible to combine all these individual instances into one, and then use RBAC to grant access to data as needed?

0 Karma

Jarohnimo
Builder

It's definitely possible to combine as one environment but not what we're looking to do.

0 Karma

wmyersas
Builder

Any particular reason why you don't want to make this a simpler deployment?

0 Karma

Jarohnimo
Builder

We're not allowed to combine into one environment for various reasons (policy related) hence the point of me going down this path. If I could combine environments this would be an easier solution no doubt.

wmyersas
Builder

That's a shame

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...