https://community.splunk.com/t5/Getting-Data-In/Can-I-configure-my-deployment-server-to-send-deployment-related/m-p/50737#M9722 <P>If you set up your deployment server as a forwarder, by adding an <CODE>outputs.conf</CODE> file, you can send its Splunk logs to your indexer. Splunk automatically monitors its internal logs, so your deployment-related logs should be sent automatically. The following example assumes that the indexer is named <CODE>yourhost.yourcompany.com</CODE> and that it is listening for input on port 9997.</P> <P><STRONG>outputs.conf</STRONG></P> <PRE><CODE>[tcpout:group1] server=yourhost.yourcompany.com:9997 </CODE></PRE> <P>If this doesn't work like you expect, make sure that your deployment server has an inputs.conf that contains something like this:</P> <PRE><CODE>[monitor://$SPLUNK_HOME/var/log/splunk] _TCP_ROUTING = * index = _internal </CODE></PRE> <P>Here is a good item in the documentation: <A href="http://docs.splunk.com/Documentation/Splunk/5.0.4/Troubleshooting/WhatSplunklogsaboutitself">What Splunk logs about itself</A></P> Thu, 29 Aug 2013 07:13:17 GMT lguinn2 2013-08-29T07:13:17Z https://community.splunk.com/t5/Getting-Data-In/Can-I-configure-my-deployment-server-to-send-deployment-related/m-p/50736#M9721 <P>I have a dedicated machine for my splunk forwarder configuration deployment server. I would like to send the deployment related logs to another Splunk instance which serves as my indexer/search node. </P> <P>Any idea how to do this? </P> Thu, 29 Aug 2013 01:56:24 GMT https://community.splunk.com/t5/Getting-Data-In/Can-I-configure-my-deployment-server-to-send-deployment-related/m-p/50736#M9721 juniormint 2013-08-29T01:56:24Z https://community.splunk.com/t5/Getting-Data-In/Can-I-configure-my-deployment-server-to-send-deployment-related/m-p/50737#M9722 <P>If you set up your deployment server as a forwarder, by adding an <CODE>outputs.conf</CODE> file, you can send its Splunk logs to your indexer. Splunk automatically monitors its internal logs, so your deployment-related logs should be sent automatically. The following example assumes that the indexer is named <CODE>yourhost.yourcompany.com</CODE> and that it is listening for input on port 9997.</P> <P><STRONG>outputs.conf</STRONG></P> <PRE><CODE>[tcpout:group1] server=yourhost.yourcompany.com:9997 </CODE></PRE> <P>If this doesn't work like you expect, make sure that your deployment server has an inputs.conf that contains something like this:</P> <PRE><CODE>[monitor://$SPLUNK_HOME/var/log/splunk] _TCP_ROUTING = * index = _internal </CODE></PRE> <P>Here is a good item in the documentation: <A href="http://docs.splunk.com/Documentation/Splunk/5.0.4/Troubleshooting/WhatSplunklogsaboutitself">What Splunk logs about itself</A></P> Thu, 29 Aug 2013 07:13:17 GMT https://community.splunk.com/t5/Getting-Data-In/Can-I-configure-my-deployment-server-to-send-deployment-related/m-p/50737#M9722 lguinn2 2013-08-29T07:13:17Z