Can we forward logs to two different indexer, if it a manual task such that to change at the inputs.conf and outputs.conf or auto at the Splunk Web itself? thks
e.g
Logs1 to indexer1
logs2 to indexer2
I hope this helps:
http://docs.splunk.com/Documentation/Splunk/6.0.2/Forwarding/Routeandfilterdatad
you have to configure props.conf, transforms.conf, outputs.conf. The step is shown in the doc above.
In your canse, you probably need to create multiple stanza with source in props.conf:
[source::YOUR_LOG1_PATH] to set specific log1 files to be sent to Indexer1
[source::YOUR_LOG2_PATH] to set specific log2 files to be sent to Indexer2
and so on.
Hello,
It's very easy.
in outputs.conf
[tcpout:indexer1]
server=Y.Y.Y.Y:9997
[tcpout:indexer2]
server=X.X.X.X:6666
for more info you can refer outputs.conf.spec file in your splunk instance.
Thanks
I hope this helps:
http://docs.splunk.com/Documentation/Splunk/6.0.2/Forwarding/Routeandfilterdatad
you have to configure props.conf, transforms.conf, outputs.conf. The step is shown in the doc above.
In your canse, you probably need to create multiple stanza with source in props.conf:
[source::YOUR_LOG1_PATH] to set specific log1 files to be sent to Indexer1
[source::YOUR_LOG2_PATH] to set specific log2 files to be sent to Indexer2
and so on.
any change forwarders need to restart
thks, if it true that it is not able to configure the multiple stanza from the GUI and need to do it manually thru the inputs.conf, right? Because the moment i configured my data inputs at the GUI, it will start to send over to indexer1 by default. If i done it manually at inputs.conf, do i need to restart the Splunk forwarder to take effect or i will take effect immediately upon changes at inputs.conf?