Splunk Search

Remotely deploy universal forwarder so that it forwards data two multiple inderxers

rajbahak
Path Finder

Hello,

I need to be able to configure universal forwarder with more than one indexing server from the command line.

The example below has only one receiving indexer. What is the best way to configure more than one receiving index server from the command line?

msiexec.exe /i splunkuniversalforwarder_x86.msi RECEIVING_INDEXER="indexer1:9997"

Thanks a lot for your time/help.

0 Karma

rajbahak
Path Finder

Hey Takajian,

Thanks for your reply. I am aware of the outputs.conf configuration that you've mentioned above. I was interested to know if the same could be achieved from a command line so that I did not have to go and edit the conf file after installing the universal forwarder..

Thanks again

0 Karma

Takajian
Builder

You can forward data to cloned targets. But you need to configure outputs.conf.

The following configuration should enable cloning. Set the following in outputs.conf:

[tcpout]
defaultGroup = group1, group2 # Clone data to group1 and group2

[tcpout:group1]
server = indexer1:9997

[tcpout:group2]
server = indexer2:9997
sendCookedData = false # Send raw TCP data(logs read by splunk)

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...