Is it possible to configure a redundant Splunk server in outputs.conf?

[derezzed]

Hi all,

Currently have setup multiple Splunk servers configured in outputs.conf for the universal forwarders but I am wondering if there is a way to specify only index to the second server if the first server becomes unreachable.

Thanks,

[derezzed]

Thanks Sanjay, exactly what I was looking for.

[SanjayReddy · Accepted solution]

@derezzed 

As per understing from your question, you want to send the data to forwarderA all the time and if forwarderA  goes down then switch to forwarderB.

you can configure two forwarder output groups.  and mention default forwader to send the data to splunk. 

[tcpout]
defaultGroup =GroupA

[tcpout:GroupA]
server = forwarderA :9997

[tcpout:GroupB]
server = forwarderB:9997

but in this case Splunk will not send the data to forwarderB if forwarderA goes down.

you need to manually update the defaultGroup name. which is not best way for hadling avaliblity .

We would suggest to try with following confguration , with following config splunk automatically load balances  the data based on time or volume. so if one of the forwarder goes down data will sent to other forwarder. 

[tcpout]
defaultGroup = HF

[tcpout:HF]
server = forwarderA:9997, forwarderB:9997

[SanjayReddy]

@derezzed 

If your issue is resolved please accept the answer

I will also request you to upvote the answers and comments here that you found useful