Hi All,
We have 2 Splunk instances first instance existing one to monitor security logs and second instance (to be) is to monitor Application logs, both are separate instances.
But universal forwarders used are having inuputs.conf configured for both instances.
First instance architecture:- UF --> Indexers
Second instance architecture :- UF-->HF-->Indexers
Below are the requirement questions:-
1) Inputs for both the instances are configured in one config file at UF layer. Can we perform routing of data at UF layer to both instances so that will be indexing the data required for that particular instance.
2)If the above option is not possible. can we drop data at indexer layer for first instance so that it will index only data required for instance 1.
e.g. abc.log and efg.log both the logs are on same UF (server123). abc.log should get forwarded to instance 1 and efg.log should get forwarded to insatnce2
