topic Re: Route event data to different target groups issue in Getting Data In

Route event data to different target groups issue

belasker — Tue, 29 Sep 2020 13:58:37 GMT

Hi Splunkers,
here are my 3 configuration files transforms,props,outputs

/// props.conf
[host:firstClient]
TRANSFORMS-routing=apacheWindows

[host:secondClient]
TRANSFORMS-routing=apacheLinux

/// transforms.conf
[apacheWindows]
REGEX= .
DEST_KEY=_TCP_ROUTING
FORMAT=apacheWindows

[apacheLinux]
REGEX= .
DEST_KEY=_TCP_ROUTING
FORMAT=apacheLinux

// outputs.conf
[tcpout]
defaultGroup = default-group

[tcpout:apacheWindows]
server=192.168.1.25:9997

[tcpout:apacheLinux]
server=192.168.1.24:9997

[tcpout:default-group]
server=192.168.1.25:9997

the issue here is when i use default-group all the data will be forwarded to the default-group address even tcpout:apacheLinux
and when i remove default-group from outputs.conf ,data is forwaded correctly to the 2 different indexers

here the example that i have followed in splunk official documentation

/////

[tcpout]
defaultGroup=everythingElseGroup

[tcpout:syslogGroup]
server=10.1.1.197:9996, 10.1.1.198:9997

[tcpout:errorGroup]
server=10.1.1.200:9999

[tcpout:everythingElseGroup]
server=10.1.1.250:6666
syslogGroup and errorGroup receive events according to the rules specified in transforms.conf. All other events get routed to the default group, everythingElseGroup.

//////

Thank you.

Re: Route event data to different target groups issue

MuS — Sun, 07 May 2017 20:13:45 GMT

Hi belasker,

If you read the docs for outputs.conf http://docs.splunk.com/Documentation/Splunk/latest/Admin/Outputsconf you will find this:

defaultGroup = <target_group>, <target_group>, ...
* The forwarder sends all data to the specified groups.
* If you don't want to forward data automatically, don't set this attribute.

That said, as soon as you use the defaultGroup in your outputs.conf Splunk will send all events to the defined group.

Hope that helps to understand the setting ...

cheers, MuS

Re: Route event data to different target groups issue

belasker — Mon, 08 May 2017 09:12:23 GMT

Thank you but In splunk official documentation (last example) they said " All other events get routed to the default group, everythingElseGroup" that means syslogGroup and errorGroup will be forwarded to the right place not the defaultgroup.