Splunk Default group

[pankajupadhyay]

On forwarder, We have placed in the outputs.conf as default group of indexer so in this case all the logs by default forward to Indexer.

But if i do not want to send specific logs to indexer which is in default group then what need to be done?

Please help

[gcusello]

Hi @pankajupadhyay,

yopu can find all the infos at https://docs.splunk.com/Documentation/Splunk/8.0.6/Forwarding/Routeandfilterdatad#Route_inputs_to_sp...

in few words:

you have to modify your outputs.conf, adding the second groupo and deleting the default group

[tcpout:systemGroup]
server=server1:9997

[tcpout:applicationGroup]
server=server2:9997

Then, in inputs.conf, you have to address each input

[monitor://.../file1.log]
_TCP_ROUTING = systemGroup

[monitor://.../file2.log]
_TCP_ROUTING = applicationGroup

Ciao.

Giuseppe

[pankajupadhyay]

@gcusello 

As per below configuration is should send the data to vesxi but it is sending the logs to Indexers as well.

Can you please let me know is there any wrong with configuration ?

outputs.conf
[tcpout:Indexers]
server = 10.1.1.1:9996,10.1.1.2:9997

[tcpout:vesxi]
server = 10.20.20.20:519
sendCookedData = false
disabled = false

Transforms.conf

[vmwaresxilogs]
REGEX = (logged out|Rejected password for user|Cannot login|logged in as|Accepted user for user|was updated on host|Password was changed for account|Destroy VM called)
DEST_KEY = _TCP_ROUTING
FORMAT = vesxi 

props.conf

[vmw-syslog]
TRANSFORMS-routing=vmwaresxilogs