Hi,
I am forwarding logs to indexer and also to third party server from my universal forwarder
I am sure what we are configured on inputs.conf that only logs will send to indexer
Now I have added another third party server on my outputs.conf , so my question will it sent whole logs or only the inputs.conf file log ..?
With your current configuration it sends all logs to the both target (indexer and syslog).
If you want to send some logs to both and some to only one then you need remove remote-server from default and add into inputs.conf _SYSLOG_ROUTING = <remote group stanza name in outputs.conf for syslog target> to send only that one. That must do on every monitoring stanza.
https://docs.splunk.com/Documentation/Splunk/7.3.3/Admin/Inputsconf
There is also _TCP_ROUTING parameter which is used with indexers.
Can you paste your inputs.conf and outputs.conf here with masked sensitive information? Then it's easier help you.
r. Ismo
Pls find the info below
cat splunkforwarder/etc/apps/search/local/inputs.conf
[monitor:///var/log]
disabled = false
index = linux
sourcetype = linux_logs
[monitor:///vitent/skipper/logs.log]
disabled = false
index = linux
sourcetype = linux_logs
sudo cat splunkforwarder/etc/system/local/outputs.conf
[tcpout]
defaultGroup = default-autolb-group,thirdparty
[tcpout:default-autolb-group]
server = 10.x.x.1:9997
[tcpout-server://10.x.x.1:9997]
[tcpout:thirdparty]
server = 10.x.x.x:514
sendCookedData = false
Thanks. This configuration seems to be correct.
1) send to splunk idx
2) send to syslog server with udp to port 514
Actually you could drop away [tcpout-server://10.x.x.1:9997] as you don't define anything there.
So what was your actual issue?
send to syslog server with udp to port 514
I want to know what are the logs will sent to syslog server through universal forwarder to thirdy party? only the logs I defined in inputs.conf ?
With your current configuration it sends all logs to the both target (indexer and syslog).
If you want to send some logs to both and some to only one then you need remove remote-server from default and add into inputs.conf _SYSLOG_ROUTING = <remote group stanza name in outputs.conf for syslog target> to send only that one. That must do on every monitoring stanza.
https://docs.splunk.com/Documentation/Splunk/7.3.3/Admin/Inputsconf
There is also _TCP_ROUTING parameter which is used with indexers.