Getting Data In

Can i use outputs.conf to send some data to one splunk environment and other data to another splunk environment?

smcdonald20
Path Finder

I work for a managed service provider.
We use Splunk to monitor servers for our clients.
One of our clients has built their own splunk instance, and wants us to forward their app log data (which we don't currently ingest) to their splunk instance.

I know that i can send data to 2 splunk environments, but my question is can i choose which data goes to which environment?
i.e. we don't want to send their log data to our environment as we are only interested in perfmon, wineventlog etc.

Thanks

Tags (1)
0 Karma

scannon4
SplunkTrust
SplunkTrust

We have some UFs that send data to our Splunk and then some data to another Splunk instance internally for a different team. We push an inputs.conf and an outputs.conf to do it. Index name needs to be same on both instances (at least that is what I do). Samples below:

inputs.conf
[WinEventLog://Security]
_TCP_ROUTING = server2.foo.com
disabled = 0
index = winseclog

outputs.conf
[tcpout:group1]
autoLBFrequency = 30
forceTimebasedAutoLB = true
useACK=true

[tcpout]
defaultGroup = group1
forwardedindex.0.whitelist = .*
indexAndForward = 0

[tcpout:server2.foo.com]
maxQueueSize = 10MB
server = server2.foo.com:9997

0 Karma

gjanders
SplunkTrust
SplunkTrust

Refer to routing and filtering data

In particular the section "Route inputs to specific indexers based on the data input" may be your best option...the document explains what to do

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...