topic Re: TCP ROUTING and Indexer Discovery in Splunk Enterprise

TCP ROUTING and Indexer Discovery- How to configure?

lrodriguez — Tue, 28 Mar 2023 22:23:09 GMT

Hello everyone!

In this scenario i have one Heavy forwarder and one indexer cluster (of course the is a Cluster Manager over there).

The HF have some inputs configured in this way (inputs.conf):

[mi_input://List_Deployment_State]

index = endpoint
sourcetype = endpoint
_TCP_ROUTING = ixChabelaGroup

And the outputs were configured in this way (outputs.conf):

[tcpout]
defaultGroup = ixChabelaGroup
defaultGroup = default-autolb-group

[tcpout:ixChabelaGroup]
server = 192.189.2.25:9997

As you can see the TCP_ROUTING is only sending data to one Indexer and we want to balance the data forwarding to the entire cluster.

My question is: what would it happen if i enable the indexer discovery in the Heavy Forwarder? as follows:

[tcpout:idxc-forwarders]

indexerDiscovery = cluster1

useACK=true

[indexer_discovery:cluster1]

master_uri = https://192.189.2.26:8089

pass4SymmKey = MyUnhashedPasswd

There will be a conflict between the indexer discovery and the _tcp_routing declared?

Or what is the proper way to configure the indexer discovery in my HF?

Thanks in advance for your support.

Re: TCP ROUTING and Indexer Discovery

richgalloway — Tue, 28 Mar 2023 19:37:17 GMT

It's not clear what will happen if _TCP_ROUTING references a name not in outputs.conf, but probably won't be what you want. I suggest removing _TCP_ROUTING settings from all inputs.conf files unless there is a need for input-specific routing. Then the settings in outputs.conf will control how data is sent to the indexers.

Re: TCP ROUTING and Indexer Discovery

lrodriguez — Tue, 28 Mar 2023 21:25:06 GMT

What do you think if i keep the two configurations in the same stanza (indexer discovery and _tcp_routing) ?
It will cause any kind of conflict?

Re: TCP ROUTING and Indexer Discovery

richgalloway — Wed, 29 Mar 2023 00:04:18 GMT

Indexer discovery and _TCP_ROUTING are not in the same stanza - they're not even in the same files. Get rid of _TCP_ROUTING.