Splitting indexes between multiple output groups

[shadysplunker]

Hi,

We are collecting the logs directly though UF and HEC in the indexer cluster. All inputs are defined in Cluster Manager and then bundle is applied to indexers. 

Currently we are sending the data to Splunk indexers as well as to other output group. Following is the config of outputs.conf under peer-apps:

[tcpout]

indexandForward=true

[tcpout:send2othergroup]

server=.....

sslPassword=.....

sendCookedData=true

This config is currently sending the same data to both the outputs. Indexing locally and then forwarding to another group. 

Is there a way to keep some indexes to be indexed locally and some to be sent only to another group? I tried using props and transforms by including _TCP_ROUTING but it is not working at all. 

Thanks in advance!

[gcusello]

Hi @shadysplunker,

did you followed the instructions at https://docs.splunk.com/Documentation/Splunk/9.2.1/Forwarding/Routeandfilterdatad#Route_inputs_to_sp... ?

see "Perform selective indexing and forwarding".

Ciao.

Giuseppe

[shadysplunker]

Hi @gcusello,

I went through the documentation but could not find any example to route HTTP inputs. Will this still work if I plan to use "outputgroup=<string>" in inputs.conf of HEC?

//Yash

[gcusello]

Hi @shadysplunker,

sorry, maybe I misunderstood.

please, describe better your requirements because tcpout is only for sending logs from a UF to an Indexer, why are you speaking of http? 

in the above link there's a description of performing a selective addressing of logs from an UF to IDXs.

Ciao.

Giuseppe