topic Re: Is there a parmeter for _TCP_ROUTING when using splunk oneshot? in Getting Data In

Is there a parmeter for _TCP_ROUTING when using splunk oneshot?

aa70627 — Wed, 30 Mar 2022 15:59:35 GMT

I currently have a UF that is sending data to two different Splunk environment.

[monitor:///data/folder1/] index=main sourcetype=applog1 _TCP_ROUTING = SplunkTEST crcSalt = <SOURCE> [monitor:///data/folder2/] index=main sourcetype=applog2 _TCP_ROUTING = SplunkPROD crcSalt = <SOURCE>

When i run the following oneshot command it sends it to my SplunkPROD. How do i ensure it sends to SplunkTEST? Is there a setting for _TCP_ROUTING

/opt/splunkforwarder/bin/splunk add oneshot /data/data/folder1/app1.log -index main -sourcetype "applog1"

Re: Is there a parmeter for _TCP_ROUTING when using splunk oneshot?

richgalloway — Tue, 29 Mar 2022 20:29:21 GMT

The oneshot command does not have a _TCP_ROUTING option.

I'm not sure the oneshot command honors inputs.conf settings since it's not a configured input.

Re: Is there a parmeter for _TCP_ROUTING when using splunk oneshot?

aa70627 — Wed, 30 Mar 2022 13:40:05 GMT

how does it determine where to send the oneshot to in this scenario? I've checked both environment and it only sends the SplunkPROD and not both.

Re: Is there a parmeter for _TCP_ROUTING when using splunk oneshot?

VatsalJagani — Wed, 30 Mar 2022 14:43:52 GMT

Splunk does not create inputs.conf stanza when using one shot.

-------

If this is something you need regularly and you are okay to move from UF to Heavy Forwarder, then you can use TCP Routing from props.conf and transforms.conf.

(This will not work on Universal Forwarder)

props.conf [applog1] TRANSFORMS-routing=my_transforms_routing transforms.conf [my_transforms_routing] REGEX=.* DEST_KEY=_TCP_ROUTING FORMAT=SplunkTEST

Please read the reference - https://docs.splunk.com/Documentation/Splunk/8.2.5/Forwarding/Routeandfilterdatad

Note - This will apply on all the data under applog1 sourcetype.

Hope this helps! If it resolves your issue, consider accepting and upvoting!!

Re: Is there a parmeter for _TCP_ROUTING when using splunk oneshot?

richgalloway — Wed, 30 Mar 2022 16:41:50 GMT

The destination will be specified in the outputs.conf file.