Splunk Dev

Send specific Index's from one Indexer to another without Clustering

troyfred
Explorer

We have a few silo'd networks and each has their own Splunk setup. My group is going to ingest specific index's from them but cannot be part of their cluster. How would I send (say for example the Security logs held in the Security_index), from Indexer 1 to indexer 2? So far most of the answers I have come across deal with clustered systems or decommissioning one indexer and search head to bring up another. Any assistance would be greatly appreciated.

Tags (1)
0 Karma

sandeepmakkena
Contributor

I'm sure there will be a better way to achieve this, for now, I can only think of below two options.

  1. Write the event of your Security_index to a file using curl commands like collect and configure other Splunk instant to monitor that file.
  2. The other way is by running the script, here is the link that could help https://docs.splunk.com/Documentation/Splunk/latest/AdvancedDev/ScriptSetup

Thanks, hope this helps!

0 Karma

troyfred
Explorer

Thanks for the answer, however our client network is super sketchy about pulling from and monitoring that way. We are basically getting a one way from from them to us. So far I have found the following articles related to this setup below. The issue I get now is that if the data is in its own index (lets say security_logs), I get everything EXCEPT those logs but if I use REGEX=(WinEventLog:Security) or REGEX=(WinEventLog | Security), I get all the WinEventLog from things that put their data into the main index.

https://docs.splunk.com/Documentation/Splunk/6.4.3/Forwarding/Routeandfilterdatad#Replicate_a_subset...
https://answers.splunk.com/answers/448100/is-it-possible-to-index-and-forward-a-specific-sou.html
https://docs.splunk.com/Documentation/Splunk/latest/Admin/Outputsconf#IndexAndForward_Processor-----

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...