Getting Data In

Is it possible to configure a redundant Splunk server in outputs.conf?

derezzed
Engager

Hi all,

Currently have setup multiple Splunk servers configured in outputs.conf for the universal forwarders but I am wondering if there is a way to specify only index to the second server if the first server becomes unreachable.

 

Thanks,

Labels (1)
0 Karma
1 Solution

SanjayReddy
SplunkTrust
SplunkTrust

@derezzed 

As per understing from your question, you want to send the data to forwarderA all the time and if forwarderA  goes down then switch to forwarderB.

you can configure two forwarder output groups.  and mention default forwader to send the data to splunk. 

[tcpout]
defaultGroup =GroupA

[tcpout:GroupA]
server = forwarderA :9997

[tcpout:GroupB]
server = forwarderB:9997


but in this case Splunk will not send the data to forwarderB if forwarderA goes down.

you need to manually update the defaultGroup name. which is not best way for hadling avaliblity .


We would suggest to try with following confguration , with following config splunk automatically load balances  the data based on time or volume. so if one of the forwarder goes down data will sent to other forwarder. 

 

[tcpout]
defaultGroup = HF

[tcpout:HF]
server = forwarderA:9997, forwarderB:9997

View solution in original post

derezzed
Engager

Thanks Sanjay, exactly what I was looking for.

0 Karma

SanjayReddy
SplunkTrust
SplunkTrust

@derezzed 

As per understing from your question, you want to send the data to forwarderA all the time and if forwarderA  goes down then switch to forwarderB.

you can configure two forwarder output groups.  and mention default forwader to send the data to splunk. 

[tcpout]
defaultGroup =GroupA

[tcpout:GroupA]
server = forwarderA :9997

[tcpout:GroupB]
server = forwarderB:9997


but in this case Splunk will not send the data to forwarderB if forwarderA goes down.

you need to manually update the defaultGroup name. which is not best way for hadling avaliblity .


We would suggest to try with following confguration , with following config splunk automatically load balances  the data based on time or volume. so if one of the forwarder goes down data will sent to other forwarder. 

 

[tcpout]
defaultGroup = HF

[tcpout:HF]
server = forwarderA:9997, forwarderB:9997

SanjayReddy
SplunkTrust
SplunkTrust

@derezzed 

If your issue is resolved please accept the answer

I will also request you to upvote the answers and comments here that you found useful

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...