Installation

How to save license usage while Indexing data and forward to another indexer?

khyoung7410
Communicator

alt text

I want to store ALL data received by Group_A.
And just data in 2_a index of Group_A want to transfer to another indexer(Group_B).
Is there a way to save the license usage?
Thank you

Labels (1)
0 Karma

khyoung7410
Communicator

I want to store Group_A and Group_B.

0 Karma

esix_splunk
Splunk Employee
Splunk Employee

On a side note, you will get 2 X License hit here. Whatever is indexed on group B will be counted against the License Master.

0 Karma

dflodstrom
Builder

Is it possible to index at site A and then forward select indexes to site B? Is there some custom replication setting that could make this possible?

0 Karma

dflodstrom
Builder

Have a look at "Configure selective indexing" on this page:
http://docs.splunk.com/Documentation/Splunk/6.2.0/Forwarding/Routeandfilterdatad#Perform_selective_i...

I believe the data will only hit the license meter one time with the configuration you are looking for.

0 Karma

khyoung7410
Communicator

Not store in Goup_A.
But store in Group_B.
Where's wrong?

Setting Config

  1. inputs.conf
    [udp://515]
    connection_host = ip
    index = a
    sourcetype = syslog_test
    _INDEX_AND_FORWARD_ROUTING=local
    _TCP_ROUTING = data_out

  2. outputs.conf
    [tcpout]
    defaultGroup = data_out
    indexAndForward = true

[indexAndForward]
index=true
selectiveIndexing=true

[tcpout:null]

disabled = true

server = 1.1.1.1:1000

[tcpout:data_out]
disabled = false
forwardedindex.0.whitelist = a

forwardedindex.1.blacklist = _.*

forwardedindex.2.blacklist = (_audit|_internal|_introspection)

forwardedindex.filter.disable = false
server = 192.168.18.136:9090

0 Karma
Get Updates on the Splunk Community!

Security Professional: Sharpen Your Defenses with These .conf25 Sessions

Sooooooooooo, guess what. .conf25 is almost here, and if you're on the Security Learning Path, this is your ...

First Steps with Splunk SOAR

Our first step was to gather a list of the playbooks we wanted and to sort them by priority.  Once this list ...

How To Build a Self-Service Observability Practice with Splunk Observability Cloud

If you’ve read our previous post on self-service observability, you already know what it is and why it ...