On forwarder, We have placed in the outputs.conf as default group of indexer so in this case all the logs by default forward to Indexer.
But if i do not want to send specific logs to indexer which is in default group then what need to be done?
Please help
Hi @pankajupadhyay,
yopu can find all the infos at https://docs.splunk.com/Documentation/Splunk/8.0.6/Forwarding/Routeandfilterdatad#Route_inputs_to_sp...
in few words:
you have to modify your outputs.conf, adding the second groupo and deleting the default group
[tcpout:systemGroup]
server=server1:9997
[tcpout:applicationGroup]
server=server2:9997
Then, in inputs.conf, you have to address each input
[monitor://.../file1.log]
_TCP_ROUTING = systemGroup
[monitor://.../file2.log]
_TCP_ROUTING = applicationGroup
Ciao.
Giuseppe
As per below configuration is should send the data to vesxi but it is sending the logs to Indexers as well.
Can you please let me know is there any wrong with configuration ?
outputs.conf
[tcpout:Indexers]
server = 10.1.1.1:9996,10.1.1.2:9997
[tcpout:vesxi]
server = 10.20.20.20:519
sendCookedData = false
disabled = false
Transforms.conf
[vmwaresxilogs]
REGEX = (logged out|Rejected password for user|Cannot login|logged in as|Accepted user for user|was updated on host|Password was changed for account|Destroy VM called)
DEST_KEY = _TCP_ROUTING
FORMAT = vesxi
props.conf
[vmw-syslog]
TRANSFORMS-routing=vmwaresxilogs