Will configuring a Universal forwarder to send the same logs to two different Splunk instances cause performance issues?

[nabhosal]

Hi All,

We are planning to configure a universal forwarder to send logs to two different Splunk instances i.e.to clone data.

Configuration we are going to use is,

In outputs.conf

[tcpout]
defaultGroup = default-autolb-group

[tcpout:indexer1]
server=A.A.A.A:9997, B.B.B.B:9997

[tcpout:indexer2]
server=C.C.C.C:9997 D.D.D.D:9997

In inputs.conf

[default]
_TCP_ROUTING = *

I just need to confirm, but will this cause performance issues on the server where the UF is installed?

[yannK · Accepted solution]

No particular performance issues, just double network traffic.
But remember that with cloning if one destination is not available, it will pause all forwarding.

[nabhosal]

Hi,

Thanks for your help.
As per your comment with cloning if one destination is not available, it will pause all forwarding, does it mean if one group is not reachable UF will stop forwarding to other also?