topic Re: What is the minimal outputs.conf for a forwarder? in Getting Data In

What is the minimal outputs.conf for a forwarder?

ddrillic — Tue, 31 Jul 2018 15:14:50 GMT

We use the following just fine -

[tcpout]
defaultGroup = indexers

[tcpout:indexers]
server = <indexer>:9997

The admin guide for the certification also mentions -

 [tcpout-server://x.x.x.x:9997]

Is it needed?

Re: What is the minimal outputs.conf for a forwarder?

sudosplunk — Tue, 31 Jul 2018 15:25:48 GMT

[tcpout-server://x.x.x.x] is just a more specific way of defining destination host(indexer). Both definitions will work fine but [tcpout-server://x.x.x.x] will take precedence.

Per docs,

############
TCP Output stanzas
############
# There are three levels of TCP Output stanzas:
# * Global: [tcpout]
# * Target group: [tcpout:<target_group>]
# * Single server: [tcpout-server://<ip address>:<port>]
#
# Settings at more specific levels override settings at higher levels. For
# example, an attribute set for a single server overrides the value of that
# attribute, if any, set at that server's target group stanza. See the
# online documentation on configuring forwarders for details.
#
# This spec file first describes the three levels of stanzas (and any
# attributes unique to a particular level).  It then describes the optional
# attributes, which can be set at any  of the three levels.


#----TCP Output Global Configuration -----
# The global configurations specified here in the [tcpout] stanza can be
# overwritten in stanzas for specific target groups, as described later.
# Note that the defaultGroup and indexAndForward attributes can only be set
# here, at the global level.
#
# Starting with 4.2, the [tcpout] stanza is no longer required.

Re: What is the minimal outputs.conf for a forwarder?

ddrillic — Tue, 31 Jul 2018 15:32:20 GMT

Very interesting.

What do they mean when saying -

Starting with 4.2, the [tcpout] stanza is no longer required.

Re: What is the minimal outputs.conf for a forwarder?

somesoni2 — Tue, 29 Sep 2020 20:45:48 GMT

Before v 4.2, you need to specify which tcpout:target_group to be used by default (using defaultGroup attribute) in tcpout stanza. With 4.2+ version, you don't have to specify defaultGroup attribute if there is only one tcpout:target_group (it detects it automatically).

Re: What is the minimal outputs.conf for a forwarder?

ddrillic — Tue, 31 Jul 2018 16:35:30 GMT

Are you saying that all that I need in outputs.conf is (assuming one group) ? -

[tcpout:indexers]
server = <indexer>:9997

Re: What is the minimal outputs.conf for a forwarder?

sudosplunk — Tue, 31 Jul 2018 16:54:57 GMT

That's right.

Please note: If you have more than one groups as below, then splunk will send events to defaultGroup (indexers_group1) if _TCP_ROUTING is not specified for data inputs in inputs.conf

[tcpout]
defaultGroup = indexers_group1

[tcpout:indexers_group1]
server = <indexer1>:9997

[tcpout:indexers_group2]
server = <indexer2>:9997

### inputs.conf ###

_TCP_ROUTING = <tcpout_group_name>,<tcpout_group_name>,<tcpout_group_name>, ...
* Comma-separated list of tcpout group names.
* Using this, you can selectively forward the data to specific indexer(s).
* Specify the tcpout group the forwarder should use when forwarding the data.
  The tcpout group names are defined in outputs.conf with
  [tcpout:<tcpout_group_name>].
* Defaults to groups specified in "defaultGroup" in [tcpout] stanza in
  outputs.conf.
* To forward data to all tcpout group names that have been defined in
  outputs.conf, set to '*' (asterisk).
* To forward data from the "_internal" index, _TCP_ROUTING must explicitly be
  set to either "*" or a specific splunktcp target group.

Re: What is the minimal outputs.conf for a forwarder?

ddrillic — Tue, 31 Jul 2018 17:03:42 GMT

Gorgeous !

Re: What is the minimal outputs.conf for a forwarder?

sudosplunk — Tue, 31 Jul 2018 17:04:45 GMT

Let me know if this helped you. I will convert my comment into answer.

Re: What is the minimal outputs.conf for a forwarder?

ddrillic — Tue, 31 Jul 2018 18:33:20 GMT

Please convert @nittala_surya.

Re: What is the minimal outputs.conf for a forwarder?

sudosplunk — Tue, 31 Jul 2018 18:37:27 GMT

Done. Thanks!