Is it possible for a heavy forwarder to clone the data to a 9997/tcp output (S2S) and a 8088/tcp httpout (HEC)?

[jariw]

L.s.,

Is it possible for a heavy forwarder to clone the data to a 9997/tcp output (S2S) and a 8088/tcp httpout (HEC)? So both will recieve the same events.

We have a heavy wich has to send the data to two clusters.  One of these clusters we want the data to be recieved by HEC, the other only has S2S.

thanks in advance

Grts  

Jari

[jariw]

Thanks for the answer.

So it doesn't matter if the target is a s2s 9997/tcp target and a 8088 Hec target at the same time? 

grts

Jari

[PickleRick · Accepted solution]

As @isoutamo said - you can route events and push them into many outputgroups at the same time.

But.

Contrary to what the outputs.conf might suggest, the httpout output while using HEC tokens doesn't really send using HEC. It sends data to the s2s endpoint using s2s protocol embedded within HTTP.

[isoutamo]

Hi

I'm not sure what you are exactly asking 😞

You could route and filter incoming events and forward those to different targets. Just use separate targets on outputs.conf and route events based on something with props and transforms.conf. Here is more about how to do it https://docs.splunk.com/Documentation/Splunk/9.1.0/Forwarding/Routeandfilterdatad

r. Ismo