How to setup forwarder details in inputs.conf?

[Naren26A]

I have existing Universal Forwarder setup for our prod Splunk Enterprise instance. Now, I am trying to setup a dev Splunk instance. I would like to receive data from the same forwarder which is already being used to provide data to prod instances.

I have set the receiver port in my new Splunk instance(lets say host ip as 10.99.1.123) as 9997. And added the same to tcpout servers list as 10.99.1.123:9997 in outputs.conf file of our universal forwarder.

But I am not able to find how to specify the forwarder details in inputs.conf file in my newly created Splunk instance.

Please let me know if the above process is correct and how to setup the inputs.conf file in order to receive data from the Universal Forwarder.

[CarsonZa]

outputs.conf

[tcpout:c]
server=server1:9997

[tcpout:d]
server=server2:9997

inputs.conf

 [monitor://path/file1.log]
 _TCP_ROUTING = c

 [monitor://path/file2.log]
 _TCP_ROUTING = d

http://docs.splunk.com/Documentation/Splunk/7.1.1/Forwarding/Routeandfilterdatad

[ddrillic]

-- But I am not able to find how to specify the forwarder details in inputs.conf file in my newly created Splunk instance.

On the indexer all that you need to do is to specify the receiving port in inputs.conf -

[splunktcp://9997]

[ddrillic]

Btw, if you already here, you might consider increasing the splunktcpin queue from its default of 512 KB to something more substantial - we set it up to 1 GB in dev and close to 3 GBs in prod.

[somesoni2]

You basically want to clone the data (get same data to DEV instance that you get in prod right now) OR you've some different set of files/directories that you want to monitor for DEV instance??

In both cases, you'd need to update your outputs.conf and inputs.conf for routing the data appropriately and would need a read to this very useful doc:
http://docs.splunk.com/Documentation/Splunk/7.1.1/Forwarding/Routeandfilterdatad#Configure_routing

[woodcock]

You configure (actually, just check, it should be there by default) inputs.conf on your Indexer to listen on 9997. You then configure outputs.conf on your forwarder to send to the Indexer. Then you also configure inputs.conf on your forwarder, probably with [monitor://...] stanza, to tell it what to send to the Indexer. Then you restart splunk everywhere and enjoy.