Unique universal forwarder to multiple destinations

[Flobzh]

Hello,

Is it possible to have only 1 Universal Forwarder installed on a Windows server and this UF sends data to 2 different Splunk instances

Ex:

1- Source: IIS logs -> Dest = SplunkCloud

2- Source: event viewer data -> Dest = On Premise Splunk Enterprise

If yes can you point to an article that help setup this?

Other possible constraint: we have a deployment server that should allow to setup both flow.

Thanks for your help

[isoutamo]

In UF you should define those two different outputs groups. Then you just add into your inputs.conf in every inputs, which doesn’t use default output group

_TCP_ROUTING = <your additional output group>

https://docs.splunk.com/Documentation/Splunk/latest/Admin/Inputsconf

If you need some routing based on content of events then you must add HF (heavy forwarder) after UF and then you can route it as @livehybrid shows.

[livehybrid · Accepted solution]

In fact, if its specific data sources which you want to send to different places then you wont need to touch props/transforms - instead you can set _TCP_ROUTING in your inputs.conf stanzas, setting the value to be the output group that you want to use, for example:

== inputs.conf ==
[monitor:///some/path/someFile.log]
index=someIndex
sourcetype=myAppLogs
_TCP_ROUTING=myOnPremOutputGroup

[monitor:///some/path/IIS/logs]
index=iis_logs
sourcetype=iis:logs
_TCP_ROUTING=mySplunkCloudOutputGroup

Also worth reading https://community.splunk.com/t5/Getting-Data-In/Issue-with-default-outputs-when-TCP-ROUTING/m-p/5097...

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

[livehybrid]

Hi @Flobzh 

Yes you can achieve this with multiple output groups in your outputs.conf and then props/transforms.conf to filter as required.

For more details documentation and examples check out https://docs.splunk.com/Documentation/SplunkCloud/latest/Forwarding/Routeandfilterdatad

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

[Flobzh]

Thanks, I'll look into this and confirm the behavior.