Installation

How to save license usage while Indexing data and forward to another indexer?

khyoung7410
Communicator

alt text

I want to store ALL data received by Group_A.
And just data in 2_a index of Group_A want to transfer to another indexer(Group_B).
Is there a way to save the license usage?
Thank you

Labels (1)
0 Karma

khyoung7410
Communicator

I want to store Group_A and Group_B.

0 Karma

esix_splunk
Splunk Employee
Splunk Employee

On a side note, you will get 2 X License hit here. Whatever is indexed on group B will be counted against the License Master.

0 Karma

dflodstrom
Builder

Is it possible to index at site A and then forward select indexes to site B? Is there some custom replication setting that could make this possible?

0 Karma

dflodstrom
Builder

Have a look at "Configure selective indexing" on this page:
http://docs.splunk.com/Documentation/Splunk/6.2.0/Forwarding/Routeandfilterdatad#Perform_selective_i...

I believe the data will only hit the license meter one time with the configuration you are looking for.

0 Karma

khyoung7410
Communicator

Not store in Goup_A.
But store in Group_B.
Where's wrong?

Setting Config

  1. inputs.conf
    [udp://515]
    connection_host = ip
    index = a
    sourcetype = syslog_test
    _INDEX_AND_FORWARD_ROUTING=local
    _TCP_ROUTING = data_out

  2. outputs.conf
    [tcpout]
    defaultGroup = data_out
    indexAndForward = true

[indexAndForward]
index=true
selectiveIndexing=true

[tcpout:null]

disabled = true

server = 1.1.1.1:1000

[tcpout:data_out]
disabled = false
forwardedindex.0.whitelist = a

forwardedindex.1.blacklist = _.*

forwardedindex.2.blacklist = (_audit|_internal|_introspection)

forwardedindex.filter.disable = false
server = 192.168.18.136:9090

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...