Is it possible to have one Splunk Windows forwarder communicate with two separate Splunk environments?

[ajdyer2000]

Hi,

I was wondering if it is possible to have one Splunk Windows forwarder on a workstation communicate with 2 separate Splunk environments.

The MSI installer file is:

msiexec.exe /i "C:\temp\splunkforwarder-7.1.2-a0c72a66db66-x64-release.msi" AGREETOLICENSE=Yes DEPLOYMENT_SERVER="SplunkServer-1:59443" SERVICESTARTTYPE=auto SET_ADMIN_USER=0 /l* C:\temp\splunkuflog.log /quiet

Would like to add SplunkServer-2

deploymentclient.conf

[target-broker:deploymentServer]
targetUri = SplunkServer-1:59443

[DavidHourani]

Hi there,

You can't connect one deployment client to two deployment servers simultaneously. Only one. For HA you will need to use DNS.

Also please be aware that using the following command writes deploymentclient.conf into splunkforwarder/etc/system/local, which means it will always be the one that is going to be used and will overwrite any configuration you try to send via DS:

msiexec.exe /i "C:\temp\splunkforwarder-7.1.2-a0c72a66db66-x64-release.msi" AGREETOLICENSE=Yes DEPLOYMENT_SERVER="SplunkServer-1:59443" SERVICESTARTTYPE=auto SET_ADMIN_USER=0 /l* C:\temp\splunkuflog.log /quiet

For that reason please avoid using this option "DEPLOYMENT_SERVER="SplunkServer-1:59443" and simply create an application under splunkforwarder/etc/apps/ that contains the deploymentclient.conf file. That will allow you to modify this configuration for all your forwarders from the deployment server. If configuration remains in system/local you will not be able to modify that without manually logging into all your forwarders.

Cheers,
David

[ajdyer2000]

Hi David,

I probably was asking the question wrong.
I want to send event data to 2 separate Splunk deployments. 1 deployment server

Thanks
Alan

[DavidHourani]

Ah, that's simple ^^ have a look here :
https://answers.splunk.com/answers/98922/how-to-send-same-data-to-multiple-separate-splunk-instances...
You should have an output.conf like this :

[tcpout]
defaultGroup=indexerGroup1,indexerGroup2

[tcpout:indexerGroup1]
server=10.1.1.197:9997,10.1.1.198:9997

[tcpout:indexerGroup2]
server=10.1.1.200:9997,10.1.1.201:9997

That will duplicate data to both groups.
Cheers,
David

[sduff_splunk]

To clarify, do you want to use 2 deployment servers for your client? If so, the deployment servers must be kept exactly the same, in terms of apps and configuration. Then you would need to place these behind a CNAME or common DNS entry that resolves to both of your dpeloyment servers, and configure your client to communicate with this. In addition, you will need to set crossServerChecksum = true in both serverclass.conf

What is your use-case for needing this?

Or are you looking to send event data to 2 separate Splunk deployments? That is a different questions all together

[ajdyer2000]

Thanks sduff,

I want to send event data to 2 separate Splunk deployments.

Thanks
Alan