Getting Data In

Sending 2 logtypes to 2 different splunk environments

FPERVIL
Explorer

I have a few servers that have universal forwarders that need to be updated where I can send the Application data to one Splunk environment and the OS logs to another environment.  I believe this is possible but just want to know who to get this done.  I'm assuming the inputs.conf and outputs.conf need to be updated.  Just looking for guidance.

Labels (2)
Tags (3)
0 Karma

kiran_panchavat
Motivator

@FPERVIL 

https://www.tekstream.com/blog/route-data-to-multiple-destinations/ 

https://docs.splunk.com/Documentation/Splunk/9.2.0/Forwarding/Routeandfilterdatad?_gl=1*l8fn8q*_ga*O... 

You can watch this video if you stuck anywhere 

https://www.youtube.com/watch?v=AxHetwfLC0Y 

 

I hope this helps, if any reply helps you, you could add your upvote/karma points to that reply, thanks.
0 Karma

isoutamo
SplunkTrust
SplunkTrust
You should remember that if any of those target stop to work this leads quite soon that also another targets will stop as soon as queues of stalled target will be full.
0 Karma

gcusello
SplunkTrust
SplunkTrust
0 Karma
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...