topic Re: After disabling a Forwarder, it keeps talking to the receiver in Getting Data In

After disabling a Forwarder, it keeps talking to the receiver

Stefan — Sat, 04 Dec 2010 02:07:26 GMT

I had several lightweight forwarders set up, with all of them pointing towards a single Cook Fwd.

Due to a mistake on 1 of the machines (over 190 of them) I wanted to disable forwarding, did so by editing outputs.conf again and restarted.

Communications wouldn't stop, so I started searching for other copies of the file, all were empty.

I then disabled the forwarder through CLI, restarted once again, all to no avail.

After searching for the receiver's IP on the forwarder box, I found it embeded in the outputs.conf that resides inside the search APP. Cleaned it, then restarted.

That did solve the issue for me, but the question is: What gives?

Re: After disabling a Forwarder, it keeps talking to the receiver

Genti — Sat, 04 Dec 2010 07:34:17 GMT

its hard to tell what went on with your configuration, however it seems that you were not correct when saying:
"I started searching for other copies of the file, all were empty"
Somehow you had multiple outputs.conf files, the one that you deleted and the one that was residing in the search app.

Next time, you might want to run the following command and make life easier for you:

./splunk cmd btool outputs list --debug

This will tell you exactly what output.conf stanzas exist and where they are residing.

Re: After disabling a Forwarder, it keeps talking to the receiver

Stefan — Tue, 07 Dec 2010 01:15:09 GMT

Great tip, thanks !!

I had tried looking for copies of the file using "find outputs.conf".That returned several files but not the specific one inside Search...