<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: _TCP_ROUTING not exclusive? in Monitoring Splunk</title>
    <link>https://community.splunk.com/t5/Monitoring-Splunk/TCP-ROUTING-not-exclusive/m-p/88651#M7409</link>
    <description>&lt;P&gt;Typically you need a default group for that:&lt;BR /&gt;
Add this to your outputs.conf&lt;BR /&gt;
[tcpout]&lt;BR /&gt;
defaultGroup=nothing&lt;BR /&gt;
disabled = false&lt;BR /&gt;
indexAndForward = true&lt;/P&gt;

&lt;P&gt;&lt;A href="http://docs.splunk.com/Documentation/Splunk/4.3.1/Deploy/Forwarddatatothird-partysystemsd"&gt;http://docs.splunk.com/Documentation/Splunk/4.3.1/Deploy/Forwarddatatothird-partysystemsd&lt;/A&gt;&lt;BR /&gt;
"Note: If you want to forward only the data specifically identified in props.conf and transforms.conf, set defaultGroup=nothing."&lt;/P&gt;</description>
    <pubDate>Mon, 23 Apr 2012 21:07:23 GMT</pubDate>
    <dc:creator>chicodeme</dc:creator>
    <dc:date>2012-04-23T21:07:23Z</dc:date>
    <item>
      <title>_TCP_ROUTING not exclusive?</title>
      <link>https://community.splunk.com/t5/Monitoring-Splunk/TCP-ROUTING-not-exclusive/m-p/88650#M7408</link>
      <description>&lt;P&gt;I want to add monitoring of a file and have it forwarded to a splunk server separate than my usual indexers. So I added&lt;/P&gt;

&lt;P&gt;[monitor:///new/file]&lt;/P&gt;

&lt;P&gt;_TCP_ROUTING=testGroup&lt;/P&gt;

&lt;P&gt;to my inputs. It's indexing on the server listed in testGroup just fine. BUT it's also still forwarding to my defaultGroup. How can I forward this particular file to just the testGroup, and not defaultGroup?&lt;/P&gt;</description>
      <pubDate>Tue, 26 Apr 2011 04:23:22 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Monitoring-Splunk/TCP-ROUTING-not-exclusive/m-p/88650#M7408</guid>
      <dc:creator>dmesler</dc:creator>
      <dc:date>2011-04-26T04:23:22Z</dc:date>
    </item>
    <item>
      <title>Re: _TCP_ROUTING not exclusive?</title>
      <link>https://community.splunk.com/t5/Monitoring-Splunk/TCP-ROUTING-not-exclusive/m-p/88651#M7409</link>
      <description>&lt;P&gt;Typically you need a default group for that:&lt;BR /&gt;
Add this to your outputs.conf&lt;BR /&gt;
[tcpout]&lt;BR /&gt;
defaultGroup=nothing&lt;BR /&gt;
disabled = false&lt;BR /&gt;
indexAndForward = true&lt;/P&gt;

&lt;P&gt;&lt;A href="http://docs.splunk.com/Documentation/Splunk/4.3.1/Deploy/Forwarddatatothird-partysystemsd"&gt;http://docs.splunk.com/Documentation/Splunk/4.3.1/Deploy/Forwarddatatothird-partysystemsd&lt;/A&gt;&lt;BR /&gt;
"Note: If you want to forward only the data specifically identified in props.conf and transforms.conf, set defaultGroup=nothing."&lt;/P&gt;</description>
      <pubDate>Mon, 23 Apr 2012 21:07:23 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Monitoring-Splunk/TCP-ROUTING-not-exclusive/m-p/88651#M7409</guid>
      <dc:creator>chicodeme</dc:creator>
      <dc:date>2012-04-23T21:07:23Z</dc:date>
    </item>
  </channel>
</rss>

