Splunk Enterprise

How can I get a Splunk instance to index data and forward that same data to another Splunk instance?

andrewtrobec
Motivator

Hello,

I have two standalone Splunk instances, Splunk A and Splunk B. Splunk A has a scripted input that runs on a cron schedule and indexes results. What I am trying to do is have Splunk A send that same data to Splunk B so that it is indexed again (yes I know it's redundant and doubles license usage).

I have studied examples here https://docs.splunk.com/Documentation/Splunk/8.0.4/Forwarding/Routeandfilterdatad and have managed to get half way: Splunk A sends the data to Splunk B where it is indexed, but does not index the data itself.  Here are my config files:

props.conf

[splunk_a_sourcetype]
...
TRANSFORMS-defaultRouting=defaultRouting
TRANSFORMS-secondaryRouting=secondaryRouting

transforms.conf

[defaultRouting]
REGEX=.
DEST_KEY=queue
FORMAT=indexQueue

[secondaryRouting]
REGEX=.
DEST_KEY=_TCP_ROUTING
FORMAT=secondaryGroup

outputs.conf

[tcpout:secondaryGroup]
server=dns.for.splunk.b:9997


What am I missing so that Splunk A will index the events as well as forward them to Splunk B?

Thanks!

Andrew

Labels (3)
0 Karma
Get Updates on the Splunk Community!

Splunk Security Content for Threat Detection & Response, Q1 Roundup

Join Principal Threat Researcher, Michael Haag, as he walks through:An introduction to the Splunk Threat ...

Splunk Life | Happy Pride Month!

Happy Pride Month, Splunk Community! 🌈 In the United States, as well as many countries around the ...

SplunkTrust | Where Are They Now - Michael Uschmann

The Background Five years ago, Splunk published several videos showcasing members of the SplunkTrust to share ...