topic Re: forwardedindex.filter.disable = false ? in Getting Data In

forwardedindex.filter.disable = false ?

u346146 — Mon, 06 Feb 2012 04:58:14 GMT

Hi there

Please refer to the outputs.conf file below,

My problem is:

I am trying to send all data to group1 and only index6 to group2.

but group 2 is getting about half of all six indexes data

what am I doing wrong?

I have read http://docs.splunk.com/Documentation/Splunk/4.3/Admin/Outputsconf

about 10 times now and I am obviously missing something but what?

**outputs.conf**

    #global settings - specifing two target groups
    [tcpout]
    defaultGroup = group1, group2
    disabled = false

    # Target group settings

    [tcpout:group1]
    server = 111.111.111.111:9997
    forwardedindex.filter.disable = true


    [tcpout:group2]
    server = 222.222.222.222:9997
    forwardedindex.filter.disable = false
    forwardedindex.0.blacklist = index1
    forwardedindex.1.blacklist = index2
    forwardedindex.2.blacklist = index3
    forwardedindex.3.blacklist = index4
    forwardedindex.4.blacklist = index5
    forwardedindex.5.whitelist = index6

Re: forwardedindex.filter.disable = false ?

cwacha — Mon, 06 Feb 2012 08:12:53 GMT

I don't know exactly what the problem is here but we had a similar issue. Basically it turned out that

forwardedindex.filter.disable = true

was not working at all. We had to leave it on default = false and add everything to the white and blacklists.

Maybe defaultGroup = grou1, group2 might do load balancing between the two...???

Re: forwardedindex.filter.disable = false ?

mibrahim — Tue, 07 Feb 2012 01:46:40 GMT

Some suggestions I would make:

1 – tcpout:group1

forwardedindex.filter.disable = false
Then put the Indexes you want to forward in black and whitelist like you did for group 2. Ideally blacklisting Index6

2 – group2 looks good.

Once you make the change restart Splunk on that forwarder..

Re: forwardedindex.filter.disable = false ?

gpburgett — Mon, 23 Apr 2012 05:22:08 GMT

I'm getting the same thing. No matter where I put the outputs.conf file, the filters don't seem to apply.
Now I've disable the lines in the default outputs.conf ($SPLUNK_HOME/etc/system/default/outputs.conf) that whitelist all indexes and applied the filters there and they seem to be applied properly.

Re: forwardedindex.filter.disable = false ?

grijhwani — Thu, 11 Jul 2013 12:30:19 GMT

Did you ever get this resolved? Did you consider using

$SPLUNK_HOME/bin/splunk btool outputs list

to make sure your total config was what you expected it to be?

Re: forwardedindex.filter.disable = false ?

aafogles — Thu, 26 Jun 2014 18:35:46 GMT

I am also having this issue. I did read that the forwardedindex.filter.disable defaults to false and that forwarderindexer.filters have to be applied the the global [tcpout], but even still, the filters do not appliy. I've tried "forwardedindex.0.blacklist= ", "forwardedindex.0.blacklist=*" (both of these included a forwardedindex.1.whitelist=) and "forwardedindex.0.blacklist=" No matter what, everything that is indexed on "Indexer1" gets indexed onto "Indexer2". Has anyone found a solution yet?