Splunk Enterprise

How can I get a Splunk instance to index data and forward that same data to another Splunk instance?

andrewtrobec
Motivator

Hello,

I have two standalone Splunk instances, Splunk A and Splunk B. Splunk A has a scripted input that runs on a cron schedule and indexes results. What I am trying to do is have Splunk A send that same data to Splunk B so that it is indexed again (yes I know it's redundant and doubles license usage).

I have studied examples here https://docs.splunk.com/Documentation/Splunk/8.0.4/Forwarding/Routeandfilterdatad and have managed to get half way: Splunk A sends the data to Splunk B where it is indexed, but does not index the data itself.  Here are my config files:

props.conf

[splunk_a_sourcetype]
...
TRANSFORMS-defaultRouting=defaultRouting
TRANSFORMS-secondaryRouting=secondaryRouting

transforms.conf

[defaultRouting]
REGEX=.
DEST_KEY=queue
FORMAT=indexQueue

[secondaryRouting]
REGEX=.
DEST_KEY=_TCP_ROUTING
FORMAT=secondaryGroup

outputs.conf

[tcpout:secondaryGroup]
server=dns.for.splunk.b:9997


What am I missing so that Splunk A will index the events as well as forward them to Splunk B?

Thanks!

Andrew

Labels (3)
0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...