Getting Data In

Splunk forwarder - local logs to one Splunk server, sourcetype cisco_esa to another


I need to set up a Splunk forwarder to send /var/log/messages and /var/log/secure (with add monitor )from a machine to our main Splunk server but also send monitored files from another directory on this same server to a separete, specific Splunk server with sourcetype cisco_esa.

Can this be done by configuring inputs.conf and outputs.conf on a single Universal forwarder?

I've been able to get the individual tasks accomplished. And I'm considering running 2 instances of Universal forwarder. Just wondering if this can be done with one.

Ultra Champion

In inputs.conf you can use the _TCP_ROUTING property to target different forwarding groups in outputs.conf for the different sourcetypes being monitored.

Get Updates on the Splunk Community!

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...