Getting Data In

Need to monitor only 4 hosts - data on boarding

kiranpanchavat1
Path Finder

Hello Team, 

Splunk UF has been installed in all our 1000+ windows servers and we are monitoring those logs. Now the scenario is we have one more Splunk team in my organization and they needs to monitor the one of the path in only 4 servers/hosts in that 1000+ servers . 

we need to configure the dual feeding for those 4 windows servers.

My configuration file : 

inputs.conf  : 

[monitor://xxxx:\xxxxxxx\xxxxxxxxxx\xxxxxxxxxxxx\xxxxxxxxxxx\log*]

index=xxxxxxxxxx

sourcetype= xxxxxxxxxxxx

host = xxxxxxxxxx,xxxxxxxxxxxx,xxxxxxxxxxxx,xxxxxxxxxxxxxx -----> these are the 4 windows servers/hosts which we need to send the dual feed. 

disabled = 0

Outputs.conf

[tcpout:xxxxxxxx]

server= xxxxxxxxxxx:9997,xxxxxxxxxxx:9997,xxxxxxxxxxxxx:9997,xxxxxxxxxxxxx:9997

But after adding this configurations, they are receiving the wrong logs. How to send the logs for only those 4 servers with correct data? 

Kindly help us on this. 

 

Labels (2)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @kiranpanchavat1,

following the indications at https://docs.splunk.com/Documentation/Splunk/8.2.4/Forwarding/Routeandfilterdatad#Perform_selective_... you can send only a parte of your logs to some specified indexers and all the others to the defould ones.

Ciao.

Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @kiranpanchavat1,

following the indications at https://docs.splunk.com/Documentation/Splunk/8.2.4/Forwarding/Routeandfilterdatad#Perform_selective_... you can send only a parte of your logs to some specified indexers and all the others to the defould ones.

Ciao.

Giuseppe

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...