Getting Data In

Can single forwarder forward data to two different indexer's ??

rakesh_498115
Motivator

Hi

I am using a UF say in Machine A , its has logs at two different paths say Log Path1 and Log Path2 . Now i want this Forwarder to forward LogPath1 data to one indexer say "C" and LogPath2 data to other indexer say "D" and i dont want LogPath1 data to be present in "D" Machine and viceversa.

Is this scenario possible ?? pls help.

Tags (2)
1 Solution

chris
Motivator

Hi yes this is possible, you have to define 2 groups in outputs.conf and specify which input (log path) you want to send to which group Link to routing documentation

outputs.conf

[tcpout:c]
server=server1:9997

[tcpout:d]
server=server2:9997

inputs.conf

[monitor://path/file1.log]
_TCP_ROUTING = c

[monitor://path/file2.log]
_TCP_ROUTING = d

View solution in original post

agup006
Explorer

You can also use Fluentd Enterprise to bifurcate data to separate indexers. You can use message content, message type, hostname, etc. to route the messages between the indexers. https://fluentd.treasuredata.com/splunk-optimize

0 Karma

MartinMcNutt
Communicator

Watch out...This would be a double hit against your license.

Splunk needs to improve their DR/clustering to give better control over sending data to Hot spares or DR boxes without a double his on license.

0 Karma

jmeyers_splunk
Splunk Employee
Splunk Employee

I realize this comment is pretty old, but I wanted to supply an update to anybody who ends up here...

Indexer Clustering (http://docs.splunk.com/Documentation/Splunk/latest/Indexer/Aboutclusters) seems to take care of your needs around license consumption. It will replicate data in the background without incurring any additional splunk ingest.

0 Karma

rakesh_498115
Motivator

Can i forward data from single UF to 2 different indexers. same data in 2 different index groups. ?? is this possible.?

0 Karma

acharlieh
Influencer

yes, you configure outputs.conf as described in the docs

0 Karma

chris
Motivator

If you specify the _TCP_ROUTING for every input, this setup will not index your data twice and will therefore not count twice towards your license.

Ayn
Legend

iirc there at least used to be HA licenses that you could use for indexing on multiple indexers without having to pay double the license costs.

chris
Motivator

Hi yes this is possible, you have to define 2 groups in outputs.conf and specify which input (log path) you want to send to which group Link to routing documentation

outputs.conf

[tcpout:c]
server=server1:9997

[tcpout:d]
server=server2:9997

inputs.conf

[monitor://path/file1.log]
_TCP_ROUTING = c

[monitor://path/file2.log]
_TCP_ROUTING = d

rakesh_498115
Motivator

Thanks Chris 🙂

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...