Getting Data In

How to send the same data to multiple Splunk Enterprise platforms?

yu94
New Member

Hello,

I have a requirement of sending the same data from the SplunkForwarder agents to 2 different Splunk enterprise platforms to 2 different index.
Example -
Platform 1-- index1
Platform 2 -- index2
I need 2 different solutions

  1. how can we achieve this by changing the configs at SplunkForwarder agents only
  2. how can we achieve this by changing the configs at intermediate forwarders only

Thanks in advance.

Regards,
Thippesh

Labels (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi yu94,
If all Your Forwarders pass through Heavy Forwarders it's the same thing, otherwise you have to change configuration in HFs and in each Forwarder that don't pass through HFs.
You have to modify outputs.conf that I suggest to deploy using a Deployment Server (if you have many Forwarders).
Anyway you have to insert in your outputs.conf both the target Indexers, something like this

[tcpout:Indexer1]
server = xxx.xxx.xxx.xxx:9997
disabled = false
[tcpout-server://xxx.xxx.xxx.xxx:9997]

[tcpout:Indexer2]
server=yyy.yyy.yyy.yyy:9997
disabled = false
[tcpout-server://yyy.yyy.yyy.yyy:9997]

If you want to forward logs to both the Indexers it's sufficient to use this outputs.conf, if you want selectively send some logs to one Indexer and other to the second, you have to insert in each stanza of your inputs.conf _TCP_ROUTING = <tcpout_group_name>,<tcpout_group_name>,<tcpout_group_name>, ...

See http://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Routeandfilterdatad

Bye.
Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi yu94,
If all Your Forwarders pass through Heavy Forwarders it's the same thing, otherwise you have to change configuration in HFs and in each Forwarder that don't pass through HFs.
You have to modify outputs.conf that I suggest to deploy using a Deployment Server (if you have many Forwarders).
Anyway you have to insert in your outputs.conf both the target Indexers, something like this

[tcpout:Indexer1]
server = xxx.xxx.xxx.xxx:9997
disabled = false
[tcpout-server://xxx.xxx.xxx.xxx:9997]

[tcpout:Indexer2]
server=yyy.yyy.yyy.yyy:9997
disabled = false
[tcpout-server://yyy.yyy.yyy.yyy:9997]

If you want to forward logs to both the Indexers it's sufficient to use this outputs.conf, if you want selectively send some logs to one Indexer and other to the second, you have to insert in each stanza of your inputs.conf _TCP_ROUTING = <tcpout_group_name>,<tcpout_group_name>,<tcpout_group_name>, ...

See http://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Routeandfilterdatad

Bye.
Giuseppe

gcusello
SplunkTrust
SplunkTrust

Hi @yu94,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉

Tags (1)
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...