Getting Data In

Splitting indexes between multiple output groups

shadysplunker
Explorer

Hi,

We are collecting the logs directly though UF and HEC in the indexer cluster. All inputs are defined in Cluster Manager and then bundle is applied to indexers. 

Currently we are sending the data to Splunk indexers as well as to other output group. Following is the config of outputs.conf under peer-apps:

 

[tcpout]

indexandForward=true

 

[tcpout:send2othergroup]

server=.....

sslPassword=.....

sendCookedData=true

 

This config is currently sending the same data to both the outputs. Indexing locally and then forwarding to another group. 

Is there a way to keep some indexes to be indexed locally and some to be sent only to another group? I tried using props and transforms by including _TCP_ROUTING but it is not working at all. 

 

Thanks in advance!

 

Labels (4)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @shadysplunker,

did you followed the instructions at https://docs.splunk.com/Documentation/Splunk/9.2.1/Forwarding/Routeandfilterdatad#Route_inputs_to_sp... ?

see "Perform selective indexing and forwarding".

Ciao.

Giuseppe

0 Karma

shadysplunker
Explorer

Hi @gcusello,

I went through the documentation but could not find any example to route HTTP inputs. Will this still work if I plan to use "outputgroup=<string>" in inputs.conf of HEC?

 

//Yash

 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @shadysplunker,

sorry, maybe I misunderstood.

please, describe better your requirements because tcpout is only for sending logs from a UF to an Indexer, why are you speaking of http? 

in the above link there's a description of performing a selective addressing of logs from an UF to IDXs.

Ciao.

Giuseppe

 

0 Karma
Get Updates on the Splunk Community!

ATTENTION!! We’re MOVING (not really)

Hey, all! In an effort to keep this Slack workspace secure and also to make our new members' experience easy, ...

Splunk Admins: Build a Smarter Stack with These Must-See .conf25 Sessions

  Whether you're running a complex Splunk deployment or just getting your bearings as a new admin, .conf25 ...

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...