https://community.splunk.com/t5/All-Apps-and-Add-ons/sending-splunk-db-connect-data-to-another-indexing-cluster/m-p/409801#M50002 <P>I was hoping you can change just specific inputs in DB connect to send to a different indexing cluster. I do not see a outputs.conf in the db connect app files and i am not sure where to place something like a "_TCP_ROUTING = blah". has any one else accomplished this before? </P> <P>This is how i have been doing it for syslogs-<BR /> outputs.conf in my HWF for syslogs:<BR /> [tcpout:idxbankA]<BR /> server = splunkidx01.bla.org:9993, splunkidx02.bla.org:9993, splunkidx03.bla.org:9993, splunkidx04.blah.org:9993<BR /> autoLBFrequency = 7<BR /> forceTimebasedAutoLB = true</P> <PRE><CODE>inputs.conf [udp://100.10.10.10:514] index = blah sourcetype = blah_blah_blah connection_host = ip disabled = 0 _TCP_ROUTING = idxbankA </CODE></PRE> <P>Then they just send to a intermediate forwarder and get passed to different indexers in the _TCP_ROUTING = idxbankA. It works well so far. </P> <P>For the UF's i just changed the outputs.conf via a deployment app to send to: splunkidx01.bla.org:9993, splunkidx02.bla.org:9993, splunkidx03.bla.org:9993, splunkidx04.blah.org:9993.</P> Tue, 29 Sep 2020 19:37:30 GMT sbattista09 2020-09-29T19:37:30Z https://community.splunk.com/t5/All-Apps-and-Add-ons/sending-splunk-db-connect-data-to-another-indexing-cluster/m-p/409801#M50002 <P>I was hoping you can change just specific inputs in DB connect to send to a different indexing cluster. I do not see a outputs.conf in the db connect app files and i am not sure where to place something like a "_TCP_ROUTING = blah". has any one else accomplished this before? </P> <P>This is how i have been doing it for syslogs-<BR /> outputs.conf in my HWF for syslogs:<BR /> [tcpout:idxbankA]<BR /> server = splunkidx01.bla.org:9993, splunkidx02.bla.org:9993, splunkidx03.bla.org:9993, splunkidx04.blah.org:9993<BR /> autoLBFrequency = 7<BR /> forceTimebasedAutoLB = true</P> <PRE><CODE>inputs.conf [udp://100.10.10.10:514] index = blah sourcetype = blah_blah_blah connection_host = ip disabled = 0 _TCP_ROUTING = idxbankA </CODE></PRE> <P>Then they just send to a intermediate forwarder and get passed to different indexers in the _TCP_ROUTING = idxbankA. It works well so far. </P> <P>For the UF's i just changed the outputs.conf via a deployment app to send to: splunkidx01.bla.org:9993, splunkidx02.bla.org:9993, splunkidx03.bla.org:9993, splunkidx04.blah.org:9993.</P> Tue, 29 Sep 2020 19:37:30 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/sending-splunk-db-connect-data-to-another-indexing-cluster/m-p/409801#M50002 sbattista09 2020-09-29T19:37:30Z