Getting Data In

Will configuring a Universal forwarder to send the same logs to two different Splunk instances cause performance issues?

New Member

Hi All,

We are planning to configure a universal forwarder to send logs to two different Splunk instances i.e.to clone data.

Configuration we are going to use is,

In outputs.conf

[tcpout]
defaultGroup = default-autolb-group

[tcpout:indexer1]
server=A.A.A.A:9997, B.B.B.B:9997

[tcpout:indexer2]
server=C.C.C.C:9997 D.D.D.D:9997

In inputs.conf

[default]
TCPROUTING = *

I just need to confirm, but will this cause performance issues on the server where the UF is installed?

0 Karma
1 Solution

Splunk Employee
Splunk Employee

No particular performance issues, just double network traffic.
But remember that with cloning if one destination is not available, it will pause all forwarding.

View solution in original post

Splunk Employee
Splunk Employee

No particular performance issues, just double network traffic.
But remember that with cloning if one destination is not available, it will pause all forwarding.

View solution in original post

New Member

Hi,

Thanks for your help.
As per your comment with cloning if one destination is not available, it will pause all forwarding, does it mean if one group is not reachable UF will stop forwarding to other also?

0 Karma