Forward splunk app log from search head to the indexer within the same cluster

[shangshin]

Hi,
I installed splunk add-on app on one of the search heads. The log generated by the add-on app needs to be forwarded to its indexers so it will be visible on the other search head.

Can someone advise what config change needs to be done to achieve the goal?

Thanks in advance!

[gfuente]

Hello

You just need to configure the outputs.conf in the SH so it forwards the data to the indexers, so the other SH can search that data

Regards

[shangshin]

Thanks again for the response. Let use the website monitoring app ( http://apps.splunk.com/app/1493/ ) as an example.

The app is pinging urls and saves the result on the search head. How can I forward the result to the indexers?

The stanza you provided above will forward "all logs" to the indexer 10.1.1.197 over tcp port 9997. I just want to forward the log generated by website monitoring app. How can I achieve this?

Thank you very much!

[gfuente]

What add-on are you talking about?, so we can help you better

The indexer doesn´t need to know about fields, it just need the proper timestamp and event breaking configuration. The fields are extracted at search time, so maybe you need to copy the fields extraction into the other SH.

regarding hot wo configure outputs.conf check the docs:

http://docs.splunk.com/Documentation/Splunk/latest/Admin/Outputsconf

An example:
[tcpout:group1]
server=10.1.1.197:9997

regards

[shangshin]

Thanks for the response. Do you know if there is any app provide more detail steps on how to set this up?

I am asking this because the log generated by the splunk add-on app has meaning fields. How would the indexers know?