Getting Data In

a single forwarder to two different indexer

SplunkCSIT
Communicator

Can we forward logs to two different indexer, if it a manual task such that to change at the inputs.conf and outputs.conf or auto at the Splunk Web itself? thks
e.g
Logs1 to indexer1
logs2 to indexer2

Tags (1)
0 Karma
1 Solution

melonman
Motivator

I hope this helps:

http://docs.splunk.com/Documentation/Splunk/6.0.2/Forwarding/Routeandfilterdatad

you have to configure props.conf, transforms.conf, outputs.conf. The step is shown in the doc above.
In your canse, you probably need to create multiple stanza with source in props.conf:
[source::YOUR_LOG1_PATH] to set specific log1 files to be sent to Indexer1
[source::YOUR_LOG2_PATH] to set specific log2 files to be sent to Indexer2
and so on.

View solution in original post

linu1988
Champion

Hello,
It's very easy.

in outputs.conf

[tcpout:indexer1]
server=Y.Y.Y.Y:9997
[tcpout:indexer2]
server=X.X.X.X:6666

for more info you can refer outputs.conf.spec file in your splunk instance.

Thanks

melonman
Motivator

I hope this helps:

http://docs.splunk.com/Documentation/Splunk/6.0.2/Forwarding/Routeandfilterdatad

you have to configure props.conf, transforms.conf, outputs.conf. The step is shown in the doc above.
In your canse, you probably need to create multiple stanza with source in props.conf:
[source::YOUR_LOG1_PATH] to set specific log1 files to be sent to Indexer1
[source::YOUR_LOG2_PATH] to set specific log2 files to be sent to Indexer2
and so on.

linu1988
Champion

any change forwarders need to restart

0 Karma

SplunkCSIT
Communicator

thks, if it true that it is not able to configure the multiple stanza from the GUI and need to do it manually thru the inputs.conf, right? Because the moment i configured my data inputs at the GUI, it will start to send over to indexer1 by default. If i done it manually at inputs.conf, do i need to restart the Splunk forwarder to take effect or i will take effect immediately upon changes at inputs.conf?

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...