https://community.splunk.com/t5/Getting-Data-In/Why-is-the-forwarder-sending-data-to-dev/m-p/293724#M93566 <P>look at <CODE>outputs.conf</CODE> where you have configured data forwarding to maybe dev.<BR /> <CODE>deploymentclient.conf</CODE> would not help to troubleshoot that.<BR /> Also look at <CODE>inputs.conf</CODE> file on the forwarder.</P> Wed, 10 Jan 2018 15:51:05 GMT mayurr98 2018-01-10T15:51:05Z https://community.splunk.com/t5/Getting-Data-In/Why-is-the-forwarder-sending-data-to-dev/m-p/293722#M93564 <P>Our forwarder has the following -</P> <P>$ cat /opt/splunk/splunkforwarder/etc/system/local/deploymentclient.conf<BR /> [target-broker:deploymentServer]<BR /> targetUri = prod deployment server:8089</P> <P>However, it sends data to dev. How come?</P> Wed, 10 Jan 2018 15:26:44 GMT https://community.splunk.com/t5/Getting-Data-In/Why-is-the-forwarder-sending-data-to-dev/m-p/293722#M93564 ddrillic 2018-01-10T15:26:44Z https://community.splunk.com/t5/Getting-Data-In/Why-is-the-forwarder-sending-data-to-dev/m-p/293723#M93565 <P>The server that is sending data to dev, whats the <CODE>output.conf</CODE> file look like?</P> <P>Another possibility is your routing data via <CODE>transforms.conf</CODE></P> Wed, 10 Jan 2018 15:49:51 GMT https://community.splunk.com/t5/Getting-Data-In/Why-is-the-forwarder-sending-data-to-dev/m-p/293723#M93565 skoelpin 2018-01-10T15:49:51Z https://community.splunk.com/t5/Getting-Data-In/Why-is-the-forwarder-sending-data-to-dev/m-p/293724#M93566 <P>look at <CODE>outputs.conf</CODE> where you have configured data forwarding to maybe dev.<BR /> <CODE>deploymentclient.conf</CODE> would not help to troubleshoot that.<BR /> Also look at <CODE>inputs.conf</CODE> file on the forwarder.</P> Wed, 10 Jan 2018 15:51:05 GMT https://community.splunk.com/t5/Getting-Data-In/Why-is-the-forwarder-sending-data-to-dev/m-p/293724#M93566 mayurr98 2018-01-10T15:51:05Z https://community.splunk.com/t5/Getting-Data-In/Why-is-the-forwarder-sending-data-to-dev/m-p/293725#M93567 <P>deploymentclient.conf doesn't configure outputs. But it does tell the forwarder where to get other configurations from, which likely means the deployment server it's pointed to is sending it an app with outputs.conf configured to send to dev. Or it could be that outputs.conf was manually configured on that forwarder to send to dev.</P> <P>Run:</P> <PRE><CODE>./bin/splunk btool outputs list --debug </CODE></PRE> <P>To determine what your current outputs configuration looksl ike, and which files define that configuration. </P> Wed, 10 Jan 2018 15:56:57 GMT https://community.splunk.com/t5/Getting-Data-In/Why-is-the-forwarder-sending-data-to-dev/m-p/293725#M93567 micahkemp 2018-01-10T15:56:57Z https://community.splunk.com/t5/Getting-Data-In/Why-is-the-forwarder-sending-data-to-dev/m-p/293726#M93568 <P>Perfect - <CODE>output.conf</CODE> it is ; -) </P> Wed, 10 Jan 2018 15:57:57 GMT https://community.splunk.com/t5/Getting-Data-In/Why-is-the-forwarder-sending-data-to-dev/m-p/293726#M93568 ddrillic 2018-01-10T15:57:57Z https://community.splunk.com/t5/Getting-Data-In/Why-is-the-forwarder-sending-data-to-dev/m-p/293727#M93569 <P>Great - thank you!</P> Wed, 10 Jan 2018 15:58:16 GMT https://community.splunk.com/t5/Getting-Data-In/Why-is-the-forwarder-sending-data-to-dev/m-p/293727#M93569 ddrillic 2018-01-10T15:58:16Z https://community.splunk.com/t5/Getting-Data-In/Why-is-the-forwarder-sending-data-to-dev/m-p/293728#M93570 <P>Gorgeous @micahkemp </P> Wed, 10 Jan 2018 16:34:50 GMT https://community.splunk.com/t5/Getting-Data-In/Why-is-the-forwarder-sending-data-to-dev/m-p/293728#M93570 ddrillic 2018-01-10T16:34:50Z