topic Re: Splunk forwarding, need information about a stanza in inputs.conf in Getting Data In

Splunk forwarding, need information about a stanza in inputs.conf

somesoni2 — Mon, 18 Nov 2013 19:24:26 GMT

Hi,

I am trying to setup forwarding on my Splunk instance and need information about the following stanza in etc/system/local/inputs.conf.

[splunktcp://9997]
connection_host = none

What does this stanza is really used for? (not very clear with documentation)
If I am trying to setup index and forward, does this stanza play any role in that? Currently I don't have this stanza in my inputs.conf and its failing.

Appreciate your help here.

lukejadamec — Mon, 18 Nov 2013 19:27:23 GMT

On occasion you may experience all of your forwarders dropping off-line.
The stanza you mentioned fixes the problem.

How it works, no one really knows.... Well, some folks do. Looks like a DNS issue.