Is it possible to use one Deployment Server against two separate indexers?

[Jarohnimo]

Hello all,

Is it possible to use one deployment Server against two separate indexers or would I need to use two Deployment servers to achieve this?

I need to pull various logs from 100 Servers.o Could the deployment server send out the apps in a way where the logs would go to two separate indexers? I know when we initially install the forwarders on the nodes we want to receive data from, we have to specify a Deployment server + Indexer.

This is how we would like to break it up

Indexer 1) Perfmon, SQL, Event Logs
indexer 2) IIS

Please let me know if this is possible, if so how? I'd imagine it's syntax added to a .conf file somewhere. Thank you!

[muralikoppula]

You can use single deployment server against two separate indexers and universal forwarders.
You need to point your apps/add-on to indexers and universal forwarders under serverclass.conf($SPLUNK_HOME/etc/system/local/serverclass.conf).

Try something like this:

#---------------Indexer 1------------------   
[serverClass:indexer1]
filterType = whitelist
restartSplunkd = 1
repositoryLocation = /opt/splunk/etc/deployment-apps
whitelist.0 = splunk-idx1*

[serverClass:indexer1:app:perfmon]
[serverClass:indexer1:app:SQL]
[serverClass:indexer1:app:event_logs]


#---------------Indexer 2--------------------
[serverClass:indexer2]
filterType = whitelist
restartSplunkd = 1
repositoryLocation = /opt/splunk/etc/deployment-apps
whitelist.0 = splunk-idx2*

[serverClass:indexer2:app:IIS]