Getting Data In
Highlighted

How to send the same data to multiple Splunk Enterprise platforms

New Member

Hello,

I have a requirement of sending the same data from the SplunkForwarder agents to 2 different Splunk enterprise platforms to 2 different index.
Example -
Platform 1-- index1
Platform 2 -- index2
I need 2 different solutions

  1. how can we achieve this by changing the configs at SplunkForwarder agents only
  2. how can we achieve this by changing the configs at intermediate forwarders only

Thanks in advance.

Regards,
Thippesh

0 Karma
Highlighted

Re: How to send the same data to multiple Splunk Enterprise platforms

Legend

Hi yu94,
If all Your Forwarders pass through Heavy Forwarders it's the same thing, otherwise you have to change configuration in HFs and in each Forwarder that don't pass through HFs.
You have to modify outputs.conf that I suggest to deploy using a Deployment Server (if you have many Forwarders).
Anyway you have to insert in your outputs.conf both the target Indexers, something like this

[tcpout:Indexer1]
server = xxx.xxx.xxx.xxx:9997
disabled = false
[tcpout-server://xxx.xxx.xxx.xxx:9997]

[tcpout:Indexer2]
server=yyy.yyy.yyy.yyy:9997
disabled = false
[tcpout-server://yyy.yyy.yyy.yyy:9997]

If you want to forward logs to both the Indexers it's sufficient to use this outputs.conf, if you want selectively send some logs to one Indexer and other to the second, you have to insert in each stanza of your inputs.conf _TCP_ROUTING = <tcpout_group_name>,<tcpout_group_name>,<tcpout_group_name>, ...

See http://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Routeandfilterdatad

Bye.
Giuseppe

View solution in original post

0 Karma