Getting Data In

How to index locally all incoming data and forward all input data in heavy forwarder

sieutruc
Contributor

Hello,

I have one heavy forwarder that receives data from some forwarders. After that, it indexes all those data, but it forwards all its local input data to another indexer without locally indexing them. Can you suggest me how to achieve that ?
Is the configuration right in the heavy forwarder ?

outputs.conf

[tcpout]
defaultGroup = noforward
disabled=false

[indexAndForward]
index=true
selectiveIndexing=true

[tcpout:indexer01]
server=178.17.0.46:9997

inputs.conf

[script://./bin/vmstat.sh]
_TCP_ROUTING=indexer01

Do all incoming data be locally indexed in this heavy forwarder and without forwarding to indexer 01 ?

For ex:
indexer
forwarder
UF1 UF2 UF3
Data from UF1,2,3 sent to forwarder is locally indexed in forwarder without continuing forwarding to indexer. Data input from forwarder itself is sent to indexer.
That's my concerning question

Tags (1)
0 Karma

MarioM
Motivator

I donot see the _INDEX_AND_FORWARD_ROUTING attribute in your inputs.conf, have you tried:

[script://./bin/vmstat.sh]
_TCP_ROUTING=indexer01
_INDEX_AND_FORWARD_ROUTING=<any_string>

*** UPDATE ***

This should work for UF:

[splunktcp://9997]
_INDEX_AND_FORWARD_ROUTING=index_uf_local

sieutruc
Contributor

I don't want to index that input data,just only forward it to indexer, so i don't put _INDEX_AND_FORWARD_ROUTING attribute in.
I just only want all incoming data from other UFs to be locally indexed on this heavy forwarder without forwarding to other indexers.
How can i configure those incoming data ?

0 Karma

sieutruc
Contributor

I would like to use a Splunk instance that indexes incoming data and forwards all its own performance data to other indexer. It's suitable for my system. One thing more, if you have a question about my issue, i think it's better to place in comment frame.

0 Karma

dart
Splunk Employee
Splunk Employee

Why not just deploy a Universal Forwarder for the local data, and keep the configuration seperate?

0 Karma
Get Updates on the Splunk Community!

Introducing Splunk Enterprise 9.2

WATCH HERE! Watch this Tech Talk to learn about the latest features and enhancements shipped in the new Splunk ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...