Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

If I have a single data input, how can I edit my inputs and outputs.conf to send this data to 2 different hosts, indexes, and sourcetypes?

$
0
0
I have a single data input (myLog.log) and I need to send this same data to 2 different hosts, indexes and sourcetypes. I am using deployment server, so I have custom built two separate apps. **App1: inputs.conf** [monitor:///opt/splunk/var/log/myLog.log] crcSalt = disabled = 0 sourcetype = testy_testy index = test_apps **App1:outputs.conf** [tcpout] defaultGroup = myCustomer1 [tcpout:myCustomer1] server = 10.10.10.10:8089 **App2:inputs.conf** [monitor:///opt/splunk/var/log/myLog.log] crcSalt = disabled = 0 sourcetype = staging_test index = staging **App2:outputs.conf** [tcpout] defaultGroup = myCustomer2 [tcpout:myCustomer2] server = 10.10.10.20:10080 Both of these apps exist on the same machine, however, I am not seeing any data in my second index. Will the fishbucket not register this as a new data source, and is there way to configure this?

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>