Getting Data In

How to forward logs from one Splunk server to another Splunk server?

dhavamanis
Builder

Can you please tell us, how to forward the logs from one splunk server to another. because we are already receiving log from webservers and the same logs needs to transfer to customers splunk platform. Can you please provide the step by step configuration details to enable the forwarding at Splunk indexer end.

Example :

syslog format logs are coming and indexing into splunk indexer splunkindexer.xyz.com:80 and need to forward the same set of logs to splunkindexer.xyz1.com:9997 as well from splunkindexer.xyz.com:80

Update :

We want to forward the specific index data alone from one splunk indexer to another splunk farm. Can you please provide the sample outputs.conf entries with syslog format.

0 Karma

linu1988
Champion

Hello,
You can use the outputs.conf file to configure the forwarding. It will work as heavy forwarder.
But you need to specify the proper whitelist and blacklist parameters to forward correct set of indexed data. Also if you want to retain local copy you need to set up the index_forward mechanism. Please follow the documentation.

link texthttp://docs.splunk.com/Documentation/Splunk/6.1.3/admin/Outputsconf

Thanks,
L

0 Karma

dhavamanis
Builder

We want to forward the specific index data alone from one splunk indexer to another splunk farm. Can you please provide the sample outputs.conf entries with syslog format.

0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...

Secure Your Future: Mastering Upgrade Readiness for Splunk 10

Spotlight: The Splunk Health Assistant Add-On  The Splunk Health Assistant Add-On is your ultimate companion ...

Observability Unlocked: Kubernetes & Cloud Monitoring with Splunk IM

Ready to master Kubernetes and cloud monitoring like the pros? Join Splunk’s Growth Engineering team on ...