Splunk Search

Remotely deploy universal forwarder so that it forwards data two multiple inderxers

Path Finder

Hello,

I need to be able to configure universal forwarder with more than one indexing server from the command line.

The example below has only one receiving indexer. What is the best way to configure more than one receiving index server from the command line?

msiexec.exe /i splunkuniversalforwarder_x86.msi RECEIVING_INDEXER="indexer1:9997"

Thanks a lot for your time/help.

0 Karma

Path Finder

Hey Takajian,

Thanks for your reply. I am aware of the outputs.conf configuration that you've mentioned above. I was interested to know if the same could be achieved from a command line so that I did not have to go and edit the conf file after installing the universal forwarder..

Thanks again

0 Karma

Builder

You can forward data to cloned targets. But you need to configure outputs.conf.

The following configuration should enable cloning. Set the following in outputs.conf:

[tcpout]
defaultGroup = group1, group2 # Clone data to group1 and group2

[tcpout:group1]
server = indexer1:9997

[tcpout:group2]
server = indexer2:9997
sendCookedData = false # Send raw TCP data(logs read by splunk)

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!