Getting Data In

Is it possible to use one Deployment Server against two separate indexers?

Jarohnimo
Builder

Hello all,

Is it possible to use one deployment Server against two separate indexers or would I need to use two Deployment servers to achieve this?

I need to pull various logs from 100 Servers.o Could the deployment server send out the apps in a way where the logs would go to two separate indexers? I know when we initially install the forwarders on the nodes we want to receive data from, we have to specify a Deployment server + Indexer.

This is how we would like to break it up

Indexer 1) Perfmon, SQL, Event Logs
indexer 2) IIS

Please let me know if this is possible, if so how? I'd imagine it's syntax added to a .conf file somewhere. Thank you!

0 Karma

muralikoppula
Communicator

You can use single deployment server against two separate indexers and universal forwarders.
You need to point your apps/add-on to indexers and universal forwarders under serverclass.conf($SPLUNK_HOME/etc/system/local/serverclass.conf).

Try something like this:

#---------------Indexer 1------------------   
[serverClass:indexer1]
filterType = whitelist
restartSplunkd = 1
repositoryLocation = /opt/splunk/etc/deployment-apps
whitelist.0 = splunk-idx1*

[serverClass:indexer1:app:perfmon]
[serverClass:indexer1:app:SQL]
[serverClass:indexer1:app:event_logs]


#---------------Indexer 2--------------------
[serverClass:indexer2]
filterType = whitelist
restartSplunkd = 1
repositoryLocation = /opt/splunk/etc/deployment-apps
whitelist.0 = splunk-idx2*

[serverClass:indexer2:app:IIS]
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...