Getting Data In

Need to monitor only 4 hosts - data on boarding

kiranpanchavat1
Path Finder

Hello Team, 

Splunk UF has been installed in all our 1000+ windows servers and we are monitoring those logs. Now the scenario is we have one more Splunk team in my organization and they needs to monitor the one of the path in only 4 servers/hosts in that 1000+ servers . 

we need to configure the dual feeding for those 4 windows servers.

My configuration file : 

inputs.conf  : 

[monitor://xxxx:\xxxxxxx\xxxxxxxxxx\xxxxxxxxxxxx\xxxxxxxxxxx\log*]

index=xxxxxxxxxx

sourcetype= xxxxxxxxxxxx

host = xxxxxxxxxx,xxxxxxxxxxxx,xxxxxxxxxxxx,xxxxxxxxxxxxxx -----> these are the 4 windows servers/hosts which we need to send the dual feed. 

disabled = 0

Outputs.conf

[tcpout:xxxxxxxx]

server= xxxxxxxxxxx:9997,xxxxxxxxxxx:9997,xxxxxxxxxxxxx:9997,xxxxxxxxxxxxx:9997

But after adding this configurations, they are receiving the wrong logs. How to send the logs for only those 4 servers with correct data? 

Kindly help us on this. 

 

Labels (2)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @kiranpanchavat1,

following the indications at https://docs.splunk.com/Documentation/Splunk/8.2.4/Forwarding/Routeandfilterdatad#Perform_selective_... you can send only a parte of your logs to some specified indexers and all the others to the defould ones.

Ciao.

Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @kiranpanchavat1,

following the indications at https://docs.splunk.com/Documentation/Splunk/8.2.4/Forwarding/Routeandfilterdatad#Perform_selective_... you can send only a parte of your logs to some specified indexers and all the others to the defould ones.

Ciao.

Giuseppe

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...