I need a config to direct outputs to two different Splunk stacks?

[daniel333]

All,

I have a legacy install of Splunk and a new Splunk ES stack. Transition is going to take a year. So far I just use a props/transforms to move logs from one stack to another at my Heavy/Intermediate forwarder tier. But I have a log source that must go to BOTH stacks while we're in transition? Can you point me to an example of how I could do this?

[woodcock]

You need 2 apps with outputs.conf. One that goes to all forwarders like this:

# BASE SETTINGS
[tcpout]
defaultGroup = primary_indexers
autoLB = true
# When indexing a large continuous file that grows very large, a universal
# or light forwarder may become "stuck" on one indexer, trying to reach
# EOF before being able to switch to another indexer. The symptoms of this
# are congestion on *one* indexer in the pool while others seem idle, and
# possibly uneven loading of the disk usage for the target index.
# In this instance, forceTimebasedAutoLB can help!
# ** Do not enable if you have events > 64kB **
forceTimebasedAutoLB = true
# Correct an issue with the default outputs.conf for the Universal Forwarder
# or the SplunkLightForwarder app; these don't forward _internal events.
forwardedindex.2.whitelist = (_audit|_introspection|_internal)
[tcpout:primary_indexers]
server = Your:9997, Primary:9997, Indexer:9997, List:9997, Here:9997

Another THAT IS NAMED APPROPRIATELY (so that it overrides the first one) that goes to the ones that need to send to just the ones that need to multiplex to several Indexer tiers like this:

# This sends all output to BOTH the primary & secondary & terciary Indexers
[tcpout]
defaultGroup = primary_indexers,secondary_indexers,terciary_indexers
[tcpout:secondary_indexers]
server = Your:9997, Secondary:9997, Indexer:9997, List:9997, Here:9997
[tcpout:terciary_indexers]
server = Your:9997, Terciary:9997, Indexer:9997, List:9997, Here:9997