Hello,
I would like to add one intermediate Forwarder between UF(Universal Forwarder) and 2 indexer.
For ex: i want event 1 to go from UF 1,2,3 to index Example in indexer 1, and event 2 from UF 2,3 to index Example 2 in indexer 2.
Normally, i can configure if UFs and indexers are connected directly by using output.conf in each UF. But if there is intermediate Forwarder, how can i configure that forwarder will do all the same things i said ?
Can you give me one example for that ?
(i don't want to use AutoBL and my intermediate Forwarder is heavy Forwarder)
Hi sieutruc
setup your heavy forwarder to accept splunktcp and then setup output routing on the heavy forwarder. read more about routing to different indexers in the docs @ http://docs.splunk.com/Documentation/Splunk/4.3.4/Deploy/Routeandfilterdatad#Route_inputs_to_specifi...
hope this helps to get you started with data routing.
cheers,
MuS