Need to monitor only 4 hosts - data on boarding

[kiranpanchavat1]

Hello Team, 

Splunk UF has been installed in all our 1000+ windows servers and we are monitoring those logs. Now the scenario is we have one more Splunk team in my organization and they needs to monitor the one of the path in only 4 servers/hosts in that 1000+ servers . 

we need to configure the dual feeding for those 4 windows servers.

My configuration file : 

inputs.conf  : 

[monitor://xxxx:\xxxxxxx\xxxxxxxxxx\xxxxxxxxxxxx\xxxxxxxxxxx\log*]

index=xxxxxxxxxx

sourcetype= xxxxxxxxxxxx

host = xxxxxxxxxx,xxxxxxxxxxxx,xxxxxxxxxxxx,xxxxxxxxxxxxxx -----> these are the 4 windows servers/hosts which we need to send the dual feed. 

disabled = 0

Outputs.conf

[tcpout:xxxxxxxx]

server= xxxxxxxxxxx:9997,xxxxxxxxxxx:9997,xxxxxxxxxxxxx:9997,xxxxxxxxxxxxx:9997

But after adding this configurations, they are receiving the wrong logs. How to send the logs for only those 4 servers with correct data? 

Kindly help us on this. 

[gcusello · Accepted solution]

Hi @kiranpanchavat1,

following the indications at https://docs.splunk.com/Documentation/Splunk/8.2.4/Forwarding/Routeandfilterdatad#Perform_selective_... you can send only a parte of your logs to some specified indexers and all the others to the defould ones.

Ciao.

Giuseppe