Getting Data In

How to send the same data to multiple Splunk Enterprise platforms?

yu94
New Member

Hello,

I have a requirement of sending the same data from the SplunkForwarder agents to 2 different Splunk enterprise platforms to 2 different index.
Example -
Platform 1-- index1
Platform 2 -- index2
I need 2 different solutions

  1. how can we achieve this by changing the configs at SplunkForwarder agents only
  2. how can we achieve this by changing the configs at intermediate forwarders only

Thanks in advance.

Regards,
Thippesh

Labels (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi yu94,
If all Your Forwarders pass through Heavy Forwarders it's the same thing, otherwise you have to change configuration in HFs and in each Forwarder that don't pass through HFs.
You have to modify outputs.conf that I suggest to deploy using a Deployment Server (if you have many Forwarders).
Anyway you have to insert in your outputs.conf both the target Indexers, something like this

[tcpout:Indexer1]
server = xxx.xxx.xxx.xxx:9997
disabled = false
[tcpout-server://xxx.xxx.xxx.xxx:9997]

[tcpout:Indexer2]
server=yyy.yyy.yyy.yyy:9997
disabled = false
[tcpout-server://yyy.yyy.yyy.yyy:9997]

If you want to forward logs to both the Indexers it's sufficient to use this outputs.conf, if you want selectively send some logs to one Indexer and other to the second, you have to insert in each stanza of your inputs.conf _TCP_ROUTING = <tcpout_group_name>,<tcpout_group_name>,<tcpout_group_name>, ...

See http://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Routeandfilterdatad

Bye.
Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi yu94,
If all Your Forwarders pass through Heavy Forwarders it's the same thing, otherwise you have to change configuration in HFs and in each Forwarder that don't pass through HFs.
You have to modify outputs.conf that I suggest to deploy using a Deployment Server (if you have many Forwarders).
Anyway you have to insert in your outputs.conf both the target Indexers, something like this

[tcpout:Indexer1]
server = xxx.xxx.xxx.xxx:9997
disabled = false
[tcpout-server://xxx.xxx.xxx.xxx:9997]

[tcpout:Indexer2]
server=yyy.yyy.yyy.yyy:9997
disabled = false
[tcpout-server://yyy.yyy.yyy.yyy:9997]

If you want to forward logs to both the Indexers it's sufficient to use this outputs.conf, if you want selectively send some logs to one Indexer and other to the second, you have to insert in each stanza of your inputs.conf _TCP_ROUTING = <tcpout_group_name>,<tcpout_group_name>,<tcpout_group_name>, ...

See http://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Routeandfilterdatad

Bye.
Giuseppe

gcusello
SplunkTrust
SplunkTrust

Hi @yu94,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉

Tags (1)
0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...