Getting Data In

Forward data

rjfv8205
Path Finder

Hello splunkers

I have indexer clustering environment with 1 master, 2 indexers (peer nodes) and 1 searchead

I want to send logs from machine with UF to splunk through conf files

I created new index with repFactor = auto.

My question is, I specify two indexers or only one in outputs.conf?

Tags (1)
0 Karma

nickhills
Ultra Champion

in outputs you want something like:

[tcpout]
defaultGroup = my-cluster-peers

[tcpout:my-cluster-peers]
server = my-peer-01:9997,my-peer-02:9997
If my comment helps, please give it a thumbs up!
0 Karma

damann
Communicator

You have to specify both Indexers in your outputs.conf and deploy it on each forwarder.
For example:

[tcpout:indexers]
server = IDX1:9997,IDX2:9997
useACK = true
0 Karma

rjfv8205
Path Finder

@damann thanks for your answers

What useACK do? It's necessary?

0 Karma

nickhills
Ultra Champion

I would avoid useAck Unless you really need it.
https://docs.splunk.com/Documentation/Splunk/latest/Admin/Outputsconf#TCPOUT_SETTINGS
(right at the bottom)

If my comment helps, please give it a thumbs up!
0 Karma

damann
Communicator

I just found the option useAck as a Splunk 'Best Practice' in my lecture documents from Cluster Admin...

0 Karma

nickhills
Ultra Champion

It has benefits - if you really cant afford to ever loose events, but it can cause duplication. It also puts more load on the UFs, and can cause slight delays, but these are probably negligible for most UFs
It makes a lot of sense if your network is 'questionable' but if your indexers and forwarders are on a 'good' local network, its probably not necessary.

If my comment helps, please give it a thumbs up!
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...