Hi All,
We are planning to configure a universal forwarder to send logs to two different Splunk instances i.e.to clone data.
Configuration we are going to use is,
In outputs.conf
[tcpout]
defaultGroup = default-autolb-group
[tcpout:indexer1]
server=A.A.A.A:9997, B.B.B.B:9997
[tcpout:indexer2]
server=C.C.C.C:9997 D.D.D.D:9997
In inputs.conf
[default]
_TCP_ROUTING = *
I just need to confirm, but will this cause performance issues on the server where the UF is installed?
No particular performance issues, just double network traffic.
But remember that with cloning if one destination is not available, it will pause all forwarding.
No particular performance issues, just double network traffic.
But remember that with cloning if one destination is not available, it will pause all forwarding.
Hi,
Thanks for your help.
As per your comment with cloning if one destination is not available, it will pause all forwarding, does it mean if one group is not reachable UF will stop forwarding to other also?