topic Re: Forwarding and receiving - Error occurred attempting to remove a tcpout input from Splunk Web in Getting Data In

Forwarding and receiving - Error occurred attempting to remove a tcpout input from Splunk Web

season88481 — Sat, 04 Jun 2016 04:55:42 GMT

Hi guys,

I configured my all-in-one Splunk instance to forward data to another search head by using an tcpout:9997 at outputs.conf. Then I removed the config file manually from Ubuntu command line.

However, I found data from my all-in-one Splunk box still forwarding to the other SH after reboot.

So I checked Forwarding and receiving setting from Splunk Web. I found the previous setting still there. Please see the attached screenshot for details.

Is there a way to remove those two forward data configurations from either Splunk Web or CMD?

Could any one please help?

Cheers,
Vincent

Re: Forwarding and receiving - Error occurred attempting to remove a tcpout input from Splunk Web

season88481 — Sat, 04 Jun 2016 05:03:40 GMT

Hi everyone,

I used btool find a configuration in one of my apps has a tcpout setup at outputs.conf.

So I removed the configuration and restart Splunk. Issue is now resolved. 🙂

Re: Forwarding and receiving - Error occurred attempting to remove a tcpout input from Splunk Web

robinsonk — Tue, 14 Jun 2016 18:38:46 GMT

What was done to fix this issue? Experiencing the same thing in our environment

Re: Forwarding and receiving - Error occurred attempting to remove a tcpout input from Splunk Web

season88481 — Tue, 14 Jun 2016 23:52:04 GMT

Hi robinsonk,

I assume your Splunk is in a Linux environment as well?

You can use btool to find all configurations at outputs.conf.

Something like ./splunk cmd btool outputs list --debug | grep tcpout

Find the configuration you don't want. And manually delete the configuration from outputs.conf...

Re: Forwarding and receiving - Error occurred attempting to remove a tcpout input from Splunk Web

robinsonk — Wed, 22 Jun 2016 17:25:25 GMT

no we are Windows environment.

Re: Forwarding and receiving - Error occurred attempting to remove a tcpout input from Splunk Web

season88481 — Wed, 22 Jun 2016 21:32:48 GMT

Hi Windows can use btool as well. It is basically the same. Just remove ./ at the beginner of the cmd.
Check here for more information:
http://docs.splunk.com/Documentation/Splunk/6.4.1/Troubleshooting/Usebtooltotroubleshootconfigurations