I've installed the Splunk App for CEF 2.0, configured the field mappings and destination syslog server, and pushed the generated TA to the indexers.
When I run the search though that's generated with |cefout my_routing_group the python script is throwing an error that it's an invalid routing group, which makes sense because the only place that group is defined is in the outputs.conf in the TA that's generated to go to the indexers.
Is this expected behavior? I don't see the data going to the /spool directory on the indexer. But, when I change the output group to 'cefroute' it sends the files to the spool directory on the search head. Any insight is appreciated.
There shouldn't be any errors being thrown. We do WARN if the command is being asked to run on a server where the routing group isn't present:
# atleast one routing group should exist
valid = any(group['name'].endswith('stash_cef_%s' % val) for group in input_groups['entry'])
# store routing group for easy access
self.routing = val
self.logger.warn("Invalid routing group '%s'", val)
This is expected/benign for the Search Head as this will not have the input/output routing groups installed by virtue of Splunk_TA_cefout. If this error is present on any systems which are expected to be forwarding data, then an investigation as to why the configurations are not present must be conducted.