Getting Data In

How to setup forwarder details in inputs.conf?

Naren26A
Engager

I have existing Universal Forwarder setup for our prod Splunk Enterprise instance. Now, I am trying to setup a dev Splunk instance. I would like to receive data from the same forwarder which is already being used to provide data to prod instances.

I have set the receiver port in my new Splunk instance(lets say host ip as 10.99.1.123) as 9997. And added the same to tcpout servers list as 10.99.1.123:9997 in outputs.conf file of our universal forwarder.

But I am not able to find how to specify the forwarder details in inputs.conf file in my newly created Splunk instance.

Please let me know if the above process is correct and how to setup the inputs.conf file in order to receive data from the Universal Forwarder.

0 Karma

CarsonZa
Contributor

outputs.conf

[tcpout:c]
server=server1:9997

[tcpout:d]
server=server2:9997

inputs.conf

 [monitor://path/file1.log]
 _TCP_ROUTING = c

 [monitor://path/file2.log]
 _TCP_ROUTING = d

http://docs.splunk.com/Documentation/Splunk/7.1.1/Forwarding/Routeandfilterdatad

0 Karma

ddrillic
Ultra Champion

-- But I am not able to find how to specify the forwarder details in inputs.conf file in my newly created Splunk instance.

On the indexer all that you need to do is to specify the receiving port in inputs.conf -

[splunktcp://9997]
0 Karma

ddrillic
Ultra Champion

Btw, if you already here, you might consider increasing the splunktcpin queue from its default of 512 KB to something more substantial - we set it up to 1 GB in dev and close to 3 GBs in prod.

0 Karma

somesoni2
SplunkTrust
SplunkTrust

You basically want to clone the data (get same data to DEV instance that you get in prod right now) OR you've some different set of files/directories that you want to monitor for DEV instance??

In both cases, you'd need to update your outputs.conf and inputs.conf for routing the data appropriately and would need a read to this very useful doc:
http://docs.splunk.com/Documentation/Splunk/7.1.1/Forwarding/Routeandfilterdatad#Configure_routing

0 Karma

woodcock
Esteemed Legend

You configure (actually, just check, it should be there by default) inputs.conf on your Indexer to listen on 9997. You then configure outputs.conf on your forwarder to send to the Indexer. Then you also configure inputs.conf on your forwarder, probably with [monitor://...] stanza, to tell it what to send to the Indexer. Then you restart splunk everywhere and enjoy.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...