a single forwarder to two different indexer

[SplunkCSIT]

Can we forward logs to two different indexer, if it a manual task such that to change at the inputs.conf and outputs.conf or auto at the Splunk Web itself? thks
e.g
Logs1 to indexer1
logs2 to indexer2

[linu1988]

Hello,
It's very easy.

in outputs.conf

[tcpout:indexer1]
server=Y.Y.Y.Y:9997
[tcpout:indexer2]
server=X.X.X.X:6666

for more info you can refer outputs.conf.spec file in your splunk instance.

Thanks

[melonman · Accepted solution]

I hope this helps:

http://docs.splunk.com/Documentation/Splunk/6.0.2/Forwarding/Routeandfilterdatad

you have to configure props.conf, transforms.conf, outputs.conf. The step is shown in the doc above.
In your canse, you probably need to create multiple stanza with source in props.conf:
[source::YOUR_LOG1_PATH] to set specific log1 files to be sent to Indexer1
[source::YOUR_LOG2_PATH] to set specific log2 files to be sent to Indexer2
and so on.

[linu1988]

any change forwarders need to restart

[SplunkCSIT]

thks, if it true that it is not able to configure the multiple stanza from the GUI and need to do it manually thru the inputs.conf, right? Because the moment i configured my data inputs at the GUI, it will start to send over to indexer1 by default. If i done it manually at inputs.conf, do i need to restart the Splunk forwarder to take effect or i will take effect immediately upon changes at inputs.conf?