Can I deploy a new app that only changes one of my two universal forwarders if they have the same inputs.conf?

[kteng2024]

Hi,

For example, we have 2 universal forwarders

UF1 = web01abc23
UF2 = web01cde21

Both are having same inputs.conf as under an app called "app_all_web" and this app is pushed from deployment server.

Both of the UF are same having same monitoring stanza like

[monitor://xyz.log]
sourcetype=web_log
index=abc

But I would like to add tcp_routing attribute to monitoring stanza on UF2 like below.

[monitor://xyz.log]
sourcetype=web_log
index=abc
_TCP_ROUTING=HeavyForwarders_1

If make change in the app and push it, then it will be pushed to UF1 which I don't want because I want that change only on UF2.

My idea:
create an new app
blacklist UF2 on "app_all_web"
whitelist UF2 on new app (new app contains all the changes that i need)

I would like to get suggestions is it possible to do under same app without creating new app.

[vr2312]

@kteng2024 I would suggest the approach of creating a new app and just add the attribute to it and send it to two different destinations :

web01abc23
App1
[monitor://xyz.log]
sourcetype=web_log
index=abc

web01cde21
app2
[monitor://xyz.log]
sourcetype=web_log
index=abc
_TCP_ROUTING=HeavyForwarders_1

Hope this helps.