Getting Data In

I need a config to direct outputs to two different Splunk stacks?

daniel333
Builder

All,

I have a legacy install of Splunk and a new Splunk ES stack. Transition is going to take a year. So far I just use a props/transforms to move logs from one stack to another at my Heavy/Intermediate forwarder tier. But I have a log source that must go to BOTH stacks while we're in transition? Can you point me to an example of how I could do this?

0 Karma

woodcock
Esteemed Legend

You need 2 apps with outputs.conf. One that goes to all forwarders like this:

# BASE SETTINGS
[tcpout]
defaultGroup = primary_indexers
autoLB = true
# When indexing a large continuous file that grows very large, a universal
# or light forwarder may become "stuck" on one indexer, trying to reach
# EOF before being able to switch to another indexer. The symptoms of this
# are congestion on *one* indexer in the pool while others seem idle, and
# possibly uneven loading of the disk usage for the target index.
# In this instance, forceTimebasedAutoLB can help!
# ** Do not enable if you have events > 64kB **
forceTimebasedAutoLB = true
# Correct an issue with the default outputs.conf for the Universal Forwarder
# or the SplunkLightForwarder app; these don't forward _internal events.
forwardedindex.2.whitelist = (_audit|_introspection|_internal)
[tcpout:primary_indexers]
server = Your:9997, Primary:9997, Indexer:9997, List:9997, Here:9997

Another THAT IS NAMED APPROPRIATELY (so that it overrides the first one) that goes to the ones that need to send to just the ones that need to multiplex to several Indexer tiers like this:

# This sends all output to BOTH the primary & secondary & terciary Indexers
[tcpout]
defaultGroup = primary_indexers,secondary_indexers,terciary_indexers
[tcpout:secondary_indexers]
server = Your:9997, Secondary:9997, Indexer:9997, List:9997, Here:9997
[tcpout:terciary_indexers]
server = Your:9997, Terciary:9997, Indexer:9997, List:9997, Here:9997
0 Karma
Get Updates on the Splunk Community!

Streamline Data Ingestion With Deployment Server Essentials

REGISTER NOW!Every day the list of sources Admins are responsible for gets bigger and bigger, often making the ...

Remediate Threats Faster and Simplify Investigations With Splunk Enterprise Security ...

REGISTER NOW!Join us for a Tech Talk around our latest release of Splunk Enterprise Security 7.2! We’ll walk ...

Introduction to Splunk AI

WATCH NOWHow are you using AI in Splunk? Whether you see AI as a threat or opportunity, AI is here to stay. ...