topic Re: Cluster Master Send Internal Logs To Indexer in Getting Data In

Cluster Master Send Internal Logs To Indexer

Ne_phil — Mon, 20 Feb 2023 04:36:24 GMT

Hi Splunk Community --

I'm trying to ensure that my cluster master is sending internal logs to the indexer. Which directory in my cluster master should I put outputs. conf? And are there other conf files that should accompany my outputs.conf file?

Re: Cluster Master Send Internal Logs To Indexer

SanjayReddy — Mon, 20 Feb 2023 05:16:06 GMT

Ho @Ne_phil

as a best pratcice create app in location $SPLUNK_HOME/etc/apps/

ex: clm_forwarder_outputs--->local--->outputs.conf

add indexer ips and restart splunk

Re: Cluster Master Send Internal Logs To Indexer

gcusello — Mon, 20 Feb 2023 06:37:30 GMT

Hi @Ne_phil,

Why shoud you use an outputs.conf to send Master Node's logs to indexers?

it's a single machine, you can easily configure forwarding by GUI [Settings > Forwardring and Receiving > Forwardring] and Splunk will send all logs, without thinking to which folders having to monitor.

Ciao.

Giuseppe

Re: Cluster Master Send Internal Logs To Indexer

Ne_phil — Mon, 20 Feb 2023 14:43:35 GMT

in our environment our cluster master (master node) and indexers (peer nodes) are all on separate servers and we are trying to set it up from backend instead of the GUI.

Re: Cluster Master Send Internal Logs To Indexer

Ne_phil — Mon, 20 Feb 2023 14:48:27 GMT

I’m not following the example but placing the app in$SPLUNK_HOME/etc/apps makes sense.

But why not just put the outputs.conf in $SPLUNK_HOME/etc/system/local?

Re: Cluster Master Send Internal Logs To Indexer

SanjayReddy — Mon, 20 Feb 2023 15:46:17 GMT

Hi @Ne_phil
even $SPLUNK_HOME/etc/system/local location

also works, but from etc/apps/ it can be managed globally if you place it etc/apps/.

either ways its works