Getting Data In

I am not able to send logs to 2 different indexer

saramamurthy_sp
Splunk Employee
Splunk Employee

I have a setup, where I have one production indexer and another one is development indexer. I want all the data to be flown into production and specific set of data to be flown into development indexer.

THe splunk architecture is UF>HF> IDX.

I see that one source type( ping:directory) is able to send the data to both the indexer, while the other one(inventory:a10) is sending data only to production not into development.

There are 2 indexers which are in a different cluster environment.
Indexer1 : Lewisville_Indexers
Indexer2 : DevIndexer

These are the configurations set up we have made on our environment.

UF : inputs.conf

[monitor:///opt/csv/a10/*.csv]
disabled = 0
index = inventory
sourcetype = inventory:a10
crcSalt =
initCrcLength = 1048576

[monitor:///u1/ds/logs/access]
sourcetype=ping:directory
index=ti_directory
disabled = 0

HF : props.conf

[ping:directory]
TRANSFORMS-routing=SecOps_Prod_Dev

[inventory:a10]
TRANSFORMS-routing=SecOps_Prod_Dev

Transforms.conf

[SecOps_Prod_Dev]
REGEX = .
DEST_KEY=_TCP_ROUTING
FORMAT=Lewisville_Indexers,DevIndexers

output.conf

[tcpout]
defaultGroup = Lewisville_Indexers,DevIndexers

Tags (1)
0 Karma

jpalacian
Path Finder
0 Karma

saramamurthy_sp
Splunk Employee
Splunk Employee

I would like to send it to 2 different indexers not index.

I see that one of the source type is going to production indexer but not on the development indexer. Though I have one of the other source type going to both with the same configuration, So i am little confused with this.

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...