All Apps and Add-ons

Forwarder Unix TA results to two indexers

phoenixdigital
Builder

Hi All,

I have installed the Unix TA onto a Universal Forwarder and am wanting its results be send to two independent indexers.

I have installed the Unix TA on a universal forwarder and activated it.

Tow send the same data to two indexers you use defaultGroup in outputs.conf from the documentation
http://docs.splunk.com/Documentation/Splunk/6.1.2/Admin/Outputsconf

So I have the following configs but the data is still only appearing at the indexer1 and not the indexer2.

vi /opt/splunkforwarder/etc/system/local/outputs.conf

[tcpout]
defaultGroup=indexer1,indexer2

[tcpout:indexer1]
server=10.10.10.10:9997
compressed=true

[tcpout:indexer2]
server=10.10.10.12:9997
compressed=true

inputs.conf in system probably not important for this but I thought I would include it for completeness. This works btw and the data goes to the correct indexers.

vi /opt/splunkforwarder/etc/system/local/inputs.conf

[default]
host = forwarder1

[monitor:///var/log/info.log]
disabled = false
followTail = 0
host = forwarder1
sourcetype = holdingRegisters
_TCP_ROUTING = indexer1

[monitor:///var/log/info-alt.log]
disabled = false
followTail = 0
host = forwarder1
sourcetype = holdingRegisters
_TCP_ROUTING = indexer2
0 Karma
1 Solution

phoenixdigital
Builder

Simple error. I didn't have the app installed on indexer2 which means that the index did not exist for the Unix TA. So the data had nowhere to go.

Installed the app and everything is working as expected.

View solution in original post

0 Karma

phoenixdigital
Builder

Simple error. I didn't have the app installed on indexer2 which means that the index did not exist for the Unix TA. So the data had nowhere to go.

Installed the app and everything is working as expected.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...