Getting Data In

Is it possible to configure a redundant Splunk server in outputs.conf?

derezzed
Engager

Hi all,

Currently have setup multiple Splunk servers configured in outputs.conf for the universal forwarders but I am wondering if there is a way to specify only index to the second server if the first server becomes unreachable.

 

Thanks,

Labels (1)
0 Karma
1 Solution

SanjayReddy
SplunkTrust
SplunkTrust

@derezzed 

As per understing from your question, you want to send the data to forwarderA all the time and if forwarderA  goes down then switch to forwarderB.

you can configure two forwarder output groups.  and mention default forwader to send the data to splunk. 

[tcpout]
defaultGroup =GroupA

[tcpout:GroupA]
server = forwarderA :9997

[tcpout:GroupB]
server = forwarderB:9997


but in this case Splunk will not send the data to forwarderB if forwarderA goes down.

you need to manually update the defaultGroup name. which is not best way for hadling avaliblity .


We would suggest to try with following confguration , with following config splunk automatically load balances  the data based on time or volume. so if one of the forwarder goes down data will sent to other forwarder. 

 

[tcpout]
defaultGroup = HF

[tcpout:HF]
server = forwarderA:9997, forwarderB:9997

View solution in original post

derezzed
Engager

Thanks Sanjay, exactly what I was looking for.

0 Karma

SanjayReddy
SplunkTrust
SplunkTrust

@derezzed 

As per understing from your question, you want to send the data to forwarderA all the time and if forwarderA  goes down then switch to forwarderB.

you can configure two forwarder output groups.  and mention default forwader to send the data to splunk. 

[tcpout]
defaultGroup =GroupA

[tcpout:GroupA]
server = forwarderA :9997

[tcpout:GroupB]
server = forwarderB:9997


but in this case Splunk will not send the data to forwarderB if forwarderA goes down.

you need to manually update the defaultGroup name. which is not best way for hadling avaliblity .


We would suggest to try with following confguration , with following config splunk automatically load balances  the data based on time or volume. so if one of the forwarder goes down data will sent to other forwarder. 

 

[tcpout]
defaultGroup = HF

[tcpout:HF]
server = forwarderA:9997, forwarderB:9997

SanjayReddy
SplunkTrust
SplunkTrust

@derezzed 

If your issue is resolved please accept the answer

I will also request you to upvote the answers and comments here that you found useful

0 Karma
Get Updates on the Splunk Community!

Index This | What did the zero say to the eight?

June 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

Splunk Observability Cloud's AI Assistant in Action Series: Onboarding New Hires & ...

This is the fifth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Now Playing: Splunk Education Summer Learning Premieres

It’s premiere season, and Splunk Education is rolling out new releases you won’t want to miss. Whether you’re ...