topic Re: Configuration for TCP input and TCP Output in Splunk Search

Configuration for TCP input and TCP Output

NReddy12 — Wed, 10 Jul 2024 08:46:44 GMT

We have configured inputs.conf with tcp to fetch the logs from streaming and send logs to Splunk server via TCP output. Logs are not being forwarded to Splunk server.

Could someone please share the proper set of inputs.conf and outputs.conf for reading the logs from TCP inputs ?

inputs.conf

[tcp://1.2.3.4:7514] connection_host=ip queueSize=10MB persistentQueueSize=50MB index=test_data sourcetype=testdata _TCP_ROUTING=ib_group

outputs.conf

[tcpout:ib_group] server=1.2.3.4:9997 useACK=false

Re: Configuration for TCP input and TCP Output

inventsekar — Wed, 10 Jul 2024 10:10:30 GMT

Hi @NReddy12 ...

using the btool, are you able to verify if the inputs is listed..

$SPLUNK_HOME$/bin/splunk btool inputs list --debug | grep tcp

Re: Configuration for TCP input and TCP Output

NReddy12 — Wed, 10 Jul 2024 10:27:20 GMT

Yes @inventsekar , I'm able to verify the inputs.

/opt/splunkforwarder # ./bin/splunk btool inputs list --debug | grep tcp /opt/splunkforwarder/etc/apps/SplunkUniversalForwarder/default/inputs.conf [splunktcp] /opt/splunkforwarder/etc/system/default/inputs.conf [tcp] /opt/splunkforwarder/etc/system/local/inputs.conf [tcp://10.196.246.1:7514] /opt/splunkforwarder # ./bin/splunk btool outputs list --debug | grep tcp /opt/splunkforwarder/etc/apps/SplunkUniversalForwarder/default/outputs.conf [tcpout] /opt/splunkforwarder/etc/system/default/outputs.conf tcpSendBufSz = 0 /opt/splunkforwarder/etc/system/local/outputs.conf [tcpout:ib_group]

Re: Configuration for TCP input and TCP Output

JohnEGones — Wed, 10 Jul 2024 12:09:20 GMT

I suppose I'll ask: did you verify network connectivity between the host (with I presume a UF) and the HFs? And the HFs and the Indexing peers? Makig sure there are no issues with switches or firewalls (opening needed ports etc.)

Re: Configuration for TCP input and TCP Output

NReddy12 — Wed, 10 Jul 2024 14:08:18 GMT

@JohnEGones, I have created Splunk Indexer and Splunk UF using docker-compose files. Both are running on the same host. We are able to forward the logs if we configure file monitoring in inputs.conf. But when I tried reading the data logs from TCP input, the data is not going to Indexer.

Could you please share some debugging steps to troubleshoot this issue ?

Re: Configuration for TCP input and TCP Output

JohnEGones — Wed, 10 Jul 2024 15:12:24 GMT

I am not familiar with Splunk on Docker, so I don't have any experience that will be useful here.

Some refs you may find useful:

Architecture | docker-splunk
Navigation | docker-splunk
Forwarding data into indexer - Splunk Community (Similar question)