Getting Data In

How to forward logs from one Splunk server to another Splunk server?

dhavamanis
Builder

Can you please tell us, how to forward the logs from one splunk server to another. because we are already receiving log from webservers and the same logs needs to transfer to customers splunk platform. Can you please provide the step by step configuration details to enable the forwarding at Splunk indexer end.

Example :

syslog format logs are coming and indexing into splunk indexer splunkindexer.xyz.com:80 and need to forward the same set of logs to splunkindexer.xyz1.com:9997 as well from splunkindexer.xyz.com:80

Update :

We want to forward the specific index data alone from one splunk indexer to another splunk farm. Can you please provide the sample outputs.conf entries with syslog format.

0 Karma

linu1988
Champion

Hello,
You can use the outputs.conf file to configure the forwarding. It will work as heavy forwarder.
But you need to specify the proper whitelist and blacklist parameters to forward correct set of indexed data. Also if you want to retain local copy you need to set up the index_forward mechanism. Please follow the documentation.

link texthttp://docs.splunk.com/Documentation/Splunk/6.1.3/admin/Outputsconf

Thanks,
L

0 Karma

dhavamanis
Builder

We want to forward the specific index data alone from one splunk indexer to another splunk farm. Can you please provide the sample outputs.conf entries with syslog format.

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...