Installation

How to save license usage while Indexing data and forward to another indexer?

khyoung7410
Communicator

alt text

I want to store ALL data received by Group_A.
And just data in 2_a index of Group_A want to transfer to another indexer(Group_B).
Is there a way to save the license usage?
Thank you

Labels (1)
0 Karma

khyoung7410
Communicator

I want to store Group_A and Group_B.

0 Karma

esix_splunk
Splunk Employee
Splunk Employee

On a side note, you will get 2 X License hit here. Whatever is indexed on group B will be counted against the License Master.

0 Karma

dflodstrom
Builder

Is it possible to index at site A and then forward select indexes to site B? Is there some custom replication setting that could make this possible?

0 Karma

dflodstrom
Builder

Have a look at "Configure selective indexing" on this page:
http://docs.splunk.com/Documentation/Splunk/6.2.0/Forwarding/Routeandfilterdatad#Perform_selective_i...

I believe the data will only hit the license meter one time with the configuration you are looking for.

0 Karma

khyoung7410
Communicator

Not store in Goup_A.
But store in Group_B.
Where's wrong?

Setting Config

  1. inputs.conf
    [udp://515]
    connection_host = ip
    index = a
    sourcetype = syslog_test
    _INDEX_AND_FORWARD_ROUTING=local
    _TCP_ROUTING = data_out

  2. outputs.conf
    [tcpout]
    defaultGroup = data_out
    indexAndForward = true

[indexAndForward]
index=true
selectiveIndexing=true

[tcpout:null]

disabled = true

server = 1.1.1.1:1000

[tcpout:data_out]
disabled = false
forwardedindex.0.whitelist = a

forwardedindex.1.blacklist = _.*

forwardedindex.2.blacklist = (_audit|_internal|_introspection)

forwardedindex.filter.disable = false
server = 192.168.18.136:9090

0 Karma
Get Updates on the Splunk Community!

Enhance Your Splunk App Development: New Tools & Support

UCC FrameworkAdd-on Builder has been around for quite some time. It helps build Splunk apps faster, but it ...

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...