Getting Data In

Can UF send data to multiple indexes

rashi83
Path Finder

I am using Splunk forwarder (not HEC) and want to know if I can send data to multiple indexes.
If yes, how?

Tags (1)
0 Karma

woodcock
Esteemed Legend

Using HEC, it is really easy (because you do not need to fight the fishbucket), just do multiple post calls. Is this not working for you?

0 Karma

manjunathmeti
Champion

Are you trying to index same data in multiple indexes?

0 Karma

ivanreis
Builder

you can send data to multiple indexers.
In order to do it, you have setup the outputs.conf like the sample below and deploy this file to your UF clients using the deployment server.

[tcpout]
defaultGroup = indexers

[tcpout:indexers]
server = 10.1.1.197:9997, 10.1.1.200:9997, 10.1.1.201:9997

For further information, please check this document -> https://docs.splunk.com/Documentation/Splunk/8.0.0/Admin/Outputsconf#outputs.conf.example

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...