forwarder not compressing despite being told to do so

summitcove — Tue, 05 Oct 2010 09:05:26 GMT

Hi There. I have 2 matching forwarders pointed to an indexer. One compresses, one doesn't. Any ideas why?

Machine that works

cat /opt/splunk/etc/system/local/outputs.conf 
[tcpout]
defaultGroup = my_indexers
indexAndForward = true

[tcpout:my_indexers]
compressed = true
server = splunklog:29000

[tcpout-server://splunklog:29000]
compressed = true

Machine that doesn't work

cat /opt/splunk/etc/system/local/outputs.conf 
[tcpout]
defaultGroup = my_indexers
indexAndForward = true

[tcpout:my_indexers]
compressed = true
server = splunklog:29001

[tcpout-server://splunklog:29001]
compressed = true

Indexer (machine that receives)

cat /opt/splunk/etc/system/local/inputs.conf 
[default]
host = splunk.***********.com

[splunktcp://29000]
compressed = true
enableS2SHeartbeat = true

[splunktcp://29001]
compressed = true
enableS2SHeartbeat = true

Log that proves it (10...101 is the machine that doesn't send compressed)

tail /opt/splunk/var/logs/splunk/splunkd.log
10-04-2010 19:55:16.756 ERROR TcpInputProc - Received unrecognized signature --splunk-cooked-mode-v2--! from hostname=10.***.****.101, ip=10.***.****.101, port=41119
10-04-2010 19:55:16.756 INFO  TcpInputProc - Hostname=10.***.****.101 closed connection
10-04-2010 19:55:47.771 INFO  TcpInputProc - Connection in cooked mode from 10.***.****.101
10-04-2010 19:56:18.756 ERROR PipelineDataInput - Mismatch in configuration between forwarder and indexer. Expecting compressed data, but forwarder configured to send without compression
10-04-2010 19:56:18.756 ERROR TcpInputProc - Received unrecognized signature --splunk-cooked-mode-v2--! from hostname=10.***.****.101, ip=10.***.****.101, port=41120
10-04-2010 19:56:18.756 INFO  TcpInputProc - Hostname=10.***.****.101 closed connection

Re: forwarder not compressing despite being told to do so

davidbrai — Mon, 13 Dec 2010 04:42:17 GMT

I'm having the same problem. Did you manage to fix it?

Re: forwarder not compressing despite being told to do so

rodman — Wed, 09 Jan 2013 17:56:46 GMT

I am also seeing the same behavior. My compression settings are also set the same as yours. Were you able to find an answer?

topic Re: forwarder not compressing despite being told to do so in Getting Data In

forwarder not compressing despite being told to do so

Re: forwarder not compressing despite being told to do so

Re: forwarder not compressing despite being told to do so