Getting Data In

How to configure a universal forwarder to send data coming from certain applications to specific indexes?

ramanapvr
New Member

Dear All,

I have a question on Splunk Universal Forwarder.

Requirement: We have certain unique application servers where they would be sending data to the universal forwarder on port 9997. However, once the data comes to the universal forwarder, the data should be sent to two Splunk Indexer machines on different ports and to specific indexes created. So the data coming from application1, application2, application3 servers as example should go and reside on Splunk Indexers machines to their specified Indexes. Here the universal forwarder would be acting as a proxy I can say.

Can anyone please let me know how this could be possible? I would appreciate if proper pointers with examples are provided. Thanks much all.

Thanks and Regards,
Peri

0 Karma

jkat54
SplunkTrust
SplunkTrust

You'll need a combination of _TCP_ROUTING settings in your inputs.conf and the corresponding server/tcp out stanzas in your outputs.conf

Inputs:

[monitor:///opt/app1/logs/*.log]
_TCP_ROUTING=indexer1
index=indexName
sourcetype=app1log

Outputs:

[tcpout:indexer1]
server=10.0.0.1

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...