topic Re: What is the best way to set up ouptuts.conf in a clustered environment? in Splunk Enterprise

What is the best way to set up ouptuts.conf in a clustered environment?

domino30 — Thu, 16 Feb 2023 21:04:30 GMT

There a about 3 ways to set up outputs.conf and when you trying to setup forwarders.

you can either do a cli entry to add a forwarder server(and indexer) or you cand edit outputs .conf files

We made the outputs .conf according to a tutorial we saw but were have issues getting data in.

So the question is what is broken about our outputs.conf file

(also side note originallt the.102 address wasnt in the files and neither was default-autolb group)

thanks

Re: What is the best way to set up ouptuts.conf in a clustered environment?

scelikok — Fri, 17 Feb 2023 06:25:40 GMT

Hi @domino30,

The first problem I noticed is on Indexer Discovery you should use your Cluster Manager URI. It seems you put one of the indexers uri.

Second, setting multiple output groups in tcpout causes duplicate on your indexers. Because they are the same indexers in your setup.

Please try below options;

Standart;

[tcpout] defaultGroup = default-autolb-group useAck = true [tcpout: default-autolb-group] disabled = false server = 10.4.118.101:9997,10.4.118.102:9997

Using indexer Discovery;

[indexer discovery:master] pass45ymmKey = $7$KrvL49XMjNER+igV1IXAr 3BVzBwe8rF2ruT/wbeD1kxD4PHc manager_uri = https://<cluster_manager_ip>:8089 [tcpout: group1] indexerDiscovery = master [tcpout] defaultGroup = group1 useAck = true

Re: What is the best way to set up ouptuts.conf in a clustered environment?

shandr — Tue, 25 Mar 2025 04:24:54 GMT

If you are seeing Invalid key in stanza (on start up) then check for typos

[indexer_discovery:master]
pass4SymmKey = ...

Refer to
https://docs.splunk.com/Documentation/Splunk/latest/Admin/Outputsconf#outputs.conf.spec