Hello,
I'm having a hard time finding a way forwarding all the internal logs from my Deployment server to the Index server.
My idea is to actually move from _internal > _internal instead of _internal > main index. This is basically to consolidate the license usage logs in just one server, since my deployment server is my license master.
This is how my inputs.conf file looks like:
[monitor://$SPLUNK_HOME/var/log/splunk]
_TCP_ROUTING=indexserver
[monitor://$SPLUNK_HOME/etc/splunk.version]
_TCP_ROUTING=indexserver
This is how my outputs.conf file looks like:
[tcpout]
forwardedindex.0.whitelist = _internal
forwardedindex.1.whitelist = _audit
forwardedindex.filter.disable = false
indexAndForward = false
defaultGroup = indexserver
[tcpout:indexserver]
server = 10.10.10.10:9997
compressed = true
autoLB = true
[tcpout-server://10.10.10.10:9997]
sslCertPath = $SPLUNK_HOME/etc/auth/server.pem
sslRootCAPath = $SPLUNK_HOME/etc/auth/cacert.pem
sslVerifyServerCert = false
sslPassword = password
Thanks for the help,
//Santiago Aloi Deheza
Just wanted to clarify that the inputs and outputs above are correct and that it works.
It takes one day till you can actually see the rollover summary.
index=_internal source=*license_usage.log type="RolloverSummary" earliest=-30d@d
| eval _time=_time - 43200
| bin _time span=1d
| stats latest(b) AS b by slave, pool, _time
| timechart span=1d sum(b) AS volume fixedrange=false
| foreach * [eval =round(''/1024/1024/1024, 3)]
Just wanted to clarify that the inputs and outputs above are correct and that it works.
It takes one day till you can actually see the rollover summary.
index=_internal source=*license_usage.log type="RolloverSummary" earliest=-30d@d
| eval _time=_time - 43200
| bin _time span=1d
| stats latest(b) AS b by slave, pool, _time
| timechart span=1d sum(b) AS volume fixedrange=false
| foreach * [eval =round(''/1024/1024/1024, 3)]