I have one splunk indexer that receives data from a variety of hosts. I want to also forward the data coming in from about 3-4 of these hosts to a second Splunk indexer, while also indexing the data on the first indexer. All the hosts I want to forward happen to be coming in through syslog, but that might not always be true.
This is what I have on the first indexer:
In props.conf:
[host::host1.xxxxxxx.xxx]
TRANSFORMS-routing=InfoSecRouting
[host::host2.xxxxxxx.xxx]
TRANSFORMS-routing=InfoSecRouting
[host::host3.xxxxxxx.xxx]
TRANSFORMS-routing=InfoSecRouting
[host::host4.xxxxxxx.xxx]
TRANSFORMS-routing=InfoSecRouting
[host::host5.xxxxxxx.xxx]
TRANSFORMS-routing=InfoSecRouting
In transforms.conf:
[InfoSecRouting]
REGEX = .
DEST_KEY=_TCP_ROUTING
FORMAT=InfoSecGroup
In outputs.conf:
[tcpout]
defaultGroup=none
indexAndForward=true
[tcpout:InfoSecGroup]
server=10.110.70.183:9002
On the second indexer, I have the following in inputs.conf:
[default]
host = indexer2
[splunktcp://9002]
index = operations
This doesn't seem to be working. The first indexer is still indexing these hosts, but nothing is being forwarded to the second indexer. I came up with these settings based on the forwarding and routing section of the Splunk manual.
Thanks, Brian
This could be an order of operations issue with respect to when the value of "host" is being set. Out of curiousity are you using Splunk forwarders? If "host" is also being set via index-time TRANSFORMS property (which is often the case for direct syslog input), you may have to specify your TRANSFORMS to run on your source input and specify the values of "host" in the REGEX.
For instance:
## props.conf
[source::udp:514]
TRANSFORMS-routing_for_syslog = InfoSecRouting_syslog
## transforms.conf
[InfoSecRouting_syslog]
REGEX = \w{3}\s+\d+\s+\d{2}:\d{2}\d{2}\s+(host1.xxxxxxx.xxx|host2.xxxxxxx.xxx)
DEST_KEY=_TCP_ROUTING
FORMAT=InfoSecGroup
## For reference this is the $SPLUNK_HOME/etc/system/default/transforms.conf for syslog-host
[syslog-host]
DEST_KEY = MetaData:Host
REGEX = :\d\d\s+(?:\d+\s+|(?:user|daemon|local.?)\.\w+\s+)*\[?(\w[\w\.\-]{2,})\]?\s
FORMAT = host::$1