topic Forward data in Getting Data In

Forward data

rjfv8205 — Thu, 14 Mar 2019 15:15:36 GMT

Hello splunkers

I have indexer clustering environment with 1 master, 2 indexers (peer nodes) and 1 searchead

I want to send logs from machine with UF to splunk through conf files

I created new index with repFactor = auto.

My question is, I specify two indexers or only one in outputs.conf?

Re: Forward data

damann — Thu, 14 Mar 2019 15:28:54 GMT

You have to specify both Indexers in your outputs.conf and deploy it on each forwarder.
For example:

[tcpout:indexers]
server = IDX1:9997,IDX2:9997
useACK = true

Re: Forward data

nickhills — Thu, 14 Mar 2019 15:32:22 GMT

in outputs you want something like:

[tcpout]
defaultGroup = my-cluster-peers

[tcpout:my-cluster-peers]
server = my-peer-01:9997,my-peer-02:9997

Re: Forward data

rjfv8205 — Thu, 14 Mar 2019 15:33:02 GMT

@damann thanks for your answers

What useACK do? It's necessary?

Re: Forward data

nickhills — Thu, 14 Mar 2019 15:35:38 GMT

I would avoid useAck Unless you really need it.
https://docs.splunk.com/Documentation/Splunk/latest/Admin/Outputsconf#TCPOUT_SETTINGS
(right at the bottom)

Re: Forward data

damann — Thu, 14 Mar 2019 15:41:52 GMT

I just found the option useAck as a Splunk 'Best Practice' in my lecture documents from Cluster Admin...

Re: Forward data

nickhills — Thu, 14 Mar 2019 15:47:23 GMT

It has benefits - if you really cant afford to ever loose events, but it can cause duplication. It also puts more load on the UFs, and can cause slight delays, but these are probably negligible for most UFs
It makes a lot of sense if your network is 'questionable' but if your indexers and forwarders are on a 'good' local network, its probably not necessary.