https://community.splunk.com/t5/Getting-Data-In/How-to-forward-data-from-one-Splunk-indexer-to-another-indexer/m-p/173494#M34894 <P>Your input port on the receiver needs to be defined as "splunktcp" not "tcp".</P> Tue, 21 Oct 2014 22:28:23 GMT gkanapathy 2014-10-21T22:28:23Z https://community.splunk.com/t5/Getting-Data-In/How-to-forward-data-from-one-Splunk-indexer-to-another-indexer/m-p/173493#M34893 <P>I have created an outputs.conf on my Indexer. With the following stanza.</P> <PRE><CODE>[output] defaultGroup = indexerB [indexAndForward] index=true selectiveIndexing=false [tcpout:indexerB] server = 192.168.1.2:9997 </CODE></PRE> <P>This is not having the intended results. I'm expecting all data being sent that particular Splunk Indexer to be forwarded to indexerB on dst port tcp/9997.<BR /> This is the only output we see;<BR /> --splunk-cooked-mode-v3--<BR /> server01234 8089 @ _s2s_capabilities ack=0;compression=0 _raw --splunk-cooked-mode-v3-- server01234 </P> Mon, 28 Sep 2020 17:57:22 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-forward-data-from-one-Splunk-indexer-to-another-indexer/m-p/173493#M34893 gekoner 2020-09-28T17:57:22Z https://community.splunk.com/t5/Getting-Data-In/How-to-forward-data-from-one-Splunk-indexer-to-another-indexer/m-p/173494#M34894 <P>Your input port on the receiver needs to be defined as "splunktcp" not "tcp".</P> Tue, 21 Oct 2014 22:28:23 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-forward-data-from-one-Splunk-indexer-to-another-indexer/m-p/173494#M34894 gkanapathy 2014-10-21T22:28:23Z