Splunk Search

Is there a way to send a single sourcetype to a heavy forwarder?

kteng2024
Path Finder

Hi there,

Is there a way to send specific sourcetype to a heavy forwarder? For example, I would like to send the "database_access" sourcetype to the heavy forwarder for regex parsing and then send the other sourcetype ("webserver_Access") directly to the indexer.

monitor://abc.log
sourcetype=webserver_Access
index=webserver_all

monitor://cdef/log
sourcetype=database_Access
index=database_all
0 Karma

s2_splunk
Splunk Employee
Splunk Employee

Take a look at the documentation for inputs.conf, specifically the _TCP_ROUTING setting, which allows you to select your target groups defined in outputs.conf.

This post may also help understand the mechanics.

0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...