We are doing some integration with a outside service provider that already has a Splunk Universal Forwarder deployed on a server that they have dedicated to us. It is collecting some information, and sending it to the vendor's indexer.
We need to have some information sent to *our* indexer; some of the information is the same as going to the vendor's indexer (but we may want a different sourcetype or index than the vendor), some inputs will be for our indexer only.
Is this even possible with a single UF? If not, with the HF (and are there any configuration examples)? Or is my best bet to do two UF installs on the vendor's server with completely separate configurations?
↧