And if you were interested in going with Deployment Server, you would only need to duplicate the apps necessary to make connections - the app to connect to Deployment Server in the first place and the forwarders' outputs app. Basic configs, ignoring SSL, compression, custom timeouts, etc below:
(Future installs could be automated in the future by having two custom install packages, one each seeded with a yourco_all_deploymentXX app.)
== yourco_all_deploymentclient10/local/deploymentclient.conf ==
[deployment-client]
[target-broker:deploymentServer]
targetUri= 10.0.0.50:8089
== yourco_all_deploymentclient172/local/deploymentclient.conf ==
[deployment-client]
[target-broker:deploymentServer]
targetUri= 172.30.0.50:8089
== yourco_all_forwarder_outputs10/local/outputs.conf ==
[tcpout]
defaultGroup = indexers_via_10
[tcpout:indexers_via_10]
server = 10.0.0.50:9997
== yourco_all_forwarder_outputs172/local/outputs.conf ==
[tcpout]
defaultGroup = indexers_via_172
[tcpout:indexers_via_172]
server = 172.30.0.50:9997
== serverclass.conf ==
[serverClass:all]
# Everyone connect back to Deployment Server
whitelist.0 = *
[serverClass:all:app:yourco_all_deploymentclient10]
whitelist.0 = 10.*
blacklist.0 = 172.*
[serverClass:all:app:yourco_all_deploymentclient172]
whitelist.0 = 172.*
blacklist.0 = 10.*
[serverClass:forwarders]
whitelist.0 = *
blacklist.0 = splunk_infrastructure_etc
[serverClass:forwarders:app:yourco_all_forwarder_outputs10]
whitelist.0 = 10.*
blacklist.0 = 172.*
[serverClass:forwarders:app:yourco_all_forwarder_outputs172]
whitelist.0 = 172.*
blacklist.0 = 10.*
... View more