Getting Data In

How do I configure Universal forwarder to send only internal logs and discard rest of the data?

iparitosh
Path Finder

About our architecture -

  • All of our UFs send data to one UF. We call it Intermediate Universal Forwarder. (IUF)
  • IUF receives data and forwards it to splunkcloud.
  • IUF is our gateway to splunkcloud.

Goal-

  • I am building a Disaster Recovery component of this IUF.
  • When there is No DR Scenario in place, IUF needs to send only _internal logs to splunkcloud but when there is DR Scenario, it needs to send all logs to splunkcloud.
  • This way I will be able to track the UF status on all DR nodes as well and won't consume license from them when there is no DR Scenario in place.

If I can figure out how to send only _internal logs to splunk, I could bundle this configuration into a DR-Control app into the IUF.

How do I configure a UF to send only _internal logs (Both it's own and forwarded to it by other UFs) to it's default outputs.conf location (which in our case is splunkcloud) and discard all other data to null queue?

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @iparitosh,
at first, I think that you could use also the DR-IUF also in normal conditions, in this way all the other UFs divide the logs between the IUFs in normal activity and you have also less load on the main IUF, instead UFs send the logs to one of the IUFs when the other is down for maintenance or fault (Splunk manages faults).

Anyway, in you don't want this, there's a cold solution: you can enable and disable receinving on the DR-IUF, in this way, when receiving is disabled DR-IUF sends only internal logs (the UFs don't send their logs to this IUF), when it's enabled, it sends all the logs that receives from the UFs, the only problem is that this is a cold solution and you have to manually enable/disable receiving on the DR-IUF and restart Splunk on it.

Ciao.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...