Installation

How to save license usage while Indexing data and forward to another indexer?

khyoung7410
Communicator

alt text

I want to store ALL data received by Group_A.
And just data in 2_a index of Group_A want to transfer to another indexer(Group_B).
Is there a way to save the license usage?
Thank you

Labels (1)
0 Karma

khyoung7410
Communicator

I want to store Group_A and Group_B.

0 Karma

esix_splunk
Splunk Employee
Splunk Employee

On a side note, you will get 2 X License hit here. Whatever is indexed on group B will be counted against the License Master.

0 Karma

dflodstrom
Builder

Is it possible to index at site A and then forward select indexes to site B? Is there some custom replication setting that could make this possible?

0 Karma

dflodstrom
Builder

Have a look at "Configure selective indexing" on this page:
http://docs.splunk.com/Documentation/Splunk/6.2.0/Forwarding/Routeandfilterdatad#Perform_selective_i...

I believe the data will only hit the license meter one time with the configuration you are looking for.

0 Karma

khyoung7410
Communicator

Not store in Goup_A.
But store in Group_B.
Where's wrong?

Setting Config

  1. inputs.conf
    [udp://515]
    connection_host = ip
    index = a
    sourcetype = syslog_test
    _INDEX_AND_FORWARD_ROUTING=local
    _TCP_ROUTING = data_out

  2. outputs.conf
    [tcpout]
    defaultGroup = data_out
    indexAndForward = true

[indexAndForward]
index=true
selectiveIndexing=true

[tcpout:null]

disabled = true

server = 1.1.1.1:1000

[tcpout:data_out]
disabled = false
forwardedindex.0.whitelist = a

forwardedindex.1.blacklist = _.*

forwardedindex.2.blacklist = (_audit|_internal|_introspection)

forwardedindex.filter.disable = false
server = 192.168.18.136:9090

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!