Getting Data In

How do I forward the same data to two different servers?

sheltomt
Path Finder

We're prepping for a migration, so what I want is the exact same data going to OldServer and NewServer

Here's what I have so far:

Outputs.conf:

[tcpout]
autoLB = true
maxQueueSize = 500KB
forwardedindex.0.whitelist = .*
forwardedindex.1.blacklist = _.*
forwardedindex.2.whitelist = _audit
forwardedindex.filter.disable = false

[tcpout:SplunkGroup]
defaultGroup=indexer1,indexer2

[tcpout:indexer1]
server = OldServerIP:8001

[tcpout:indexer2]
server = NewServerIP:8001

inputs.conf:

[monitor:///var/log/mylog.log]
index = myindex
sourcetype = mysourcetype
_TCP_ROUTING = SplunkGroup

When I set it up like this, I get no data, so obviously something is wrong. Splunkd.log isn't showing anything outside the norm

Anyone have ideas?

0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

Try something like this for your outputs.conf

[tcpout]
autoLB = true
maxQueueSize = 500KB
forwardedindex.0.whitelist = .*
forwardedindex.1.blacklist = _.*
forwardedindex.2.whitelist = _audit
forwardedindex.filter.disable = false
defaultGroup=indexer1,indexer2

 [tcpout:indexer1]
 server = OldServerIP:8001

 [tcpout:indexer2]
 server = NewServerIP:8001

See here for more information http://docs.splunk.com/Documentation/Splunk/6.0.2/Forwarding/Configureforwarderswithoutputs.confd#Da...

View solution in original post

somesoni2
SplunkTrust
SplunkTrust

Try something like this for your outputs.conf

[tcpout]
autoLB = true
maxQueueSize = 500KB
forwardedindex.0.whitelist = .*
forwardedindex.1.blacklist = _.*
forwardedindex.2.whitelist = _audit
forwardedindex.filter.disable = false
defaultGroup=indexer1,indexer2

 [tcpout:indexer1]
 server = OldServerIP:8001

 [tcpout:indexer2]
 server = NewServerIP:8001

See here for more information http://docs.splunk.com/Documentation/Splunk/6.0.2/Forwarding/Configureforwarderswithoutputs.confd#Da...

sheltomt
Path Finder

Do I need to refer to them at all in inputs.conf, or just leave that totally off?

The way that you have it laid out it looks like it's just going to default to the cloning, so I should just be able to declare each monitored log as such:

[monitor:///var/log/mylog.log]
index = myindex
sourcetype = mysourcetype

0 Karma

somesoni2
SplunkTrust
SplunkTrust

That is correct. You don't need anything in inputs.conf if all the data is supposed to go to the defaultGroup.

The input.conf entry is required for selective routing (not relevant here but just want to bring it up).

0 Karma

sheltomt
Path Finder

Interesting

Your declaration format works just fine, however, if I don't have my NewServer reachable, OldServer won't work either

Odd. But, I figure once I work the ACLs out, everything should work as necessary.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...