I have a requirement to log the default Windows logs using the universal forwarder to our main Splunk server, and then we have another application that needs to send logs to a different set of Splunk indexers.
I am pushing the applications to the UF host via a deployment server, however how do I specify that Application B use a different set of indexers?
I think I have a conflict in the outputs.conf when I have both Application A and Application B deployed to the UF host. The outputs.conf files are located in each of the /apps/ApplicationA/default and /apps/ApplicationB/default folders.
If I have just Application A or Application B pushed on their own, the required data is pushed to the correct Splunk indexer(s). Both installed at the same time ceases to send out anything.
In your inputs.conf for the app, you can specify the index that the data source goes into. Something like:
inputs.conf in App A
[monitor:///appA-sourcetype1]
sourcetype=appA-logfile
index=appA_index
inputs.conf in App B
[monitor:///appB-sourcetype1]
sourcetype=appB-logfile
index=appB_index
It should be noted that if you have the same sourcetype defined across multiple apps, then your configurations will be read in lexicographical order.
In your inputs.conf for the app, you can specify the index that the data source goes into. Something like:
inputs.conf in App A
[monitor:///appA-sourcetype1]
sourcetype=appA-logfile
index=appA_index
inputs.conf in App B
[monitor:///appB-sourcetype1]
sourcetype=appB-logfile
index=appB_index
It should be noted that if you have the same sourcetype defined across multiple apps, then your configurations will be read in lexicographical order.