Getting Data In

Route event data to different target groups issue

belasker
New Member

Hi Splunkers,
here are my 3 configuration files transforms,props,outputs

/// props.conf
[host:firstClient]
TRANSFORMS-routing=apacheWindows

[host:secondClient]
TRANSFORMS-routing=apacheLinux

/// transforms.conf
[apacheWindows]
REGEX= .
DEST_KEY=_TCP_ROUTING
FORMAT=apacheWindows

[apacheLinux]
REGEX= .
DEST_KEY=_TCP_ROUTING
FORMAT=apacheLinux

// outputs.conf
[tcpout]
defaultGroup = default-group

[tcpout:apacheWindows]
server=192.168.1.25:9997

[tcpout:apacheLinux]
server=192.168.1.24:9997

[tcpout:default-group]
server=192.168.1.25:9997

the issue here is when i use default-group all the data will be forwarded to the default-group address even tcpout:apacheLinux
and when i remove default-group from outputs.conf ,data is forwaded correctly to the 2 different indexers

here the example that i have followed in splunk official documentation

/////

[tcpout]
defaultGroup=everythingElseGroup

[tcpout:syslogGroup]
server=10.1.1.197:9996, 10.1.1.198:9997

[tcpout:errorGroup]
server=10.1.1.200:9999

[tcpout:everythingElseGroup]
server=10.1.1.250:6666
syslogGroup and errorGroup receive events according to the rules specified in transforms.conf. All other events get routed to the default group, everythingElseGroup.

//////

Thank you.

Tags (1)
0 Karma
1 Solution

MuS
Legend

Hi belasker,

If you read the docs for outputs.conf http://docs.splunk.com/Documentation/Splunk/latest/Admin/Outputsconf you will find this:

defaultGroup = <target_group>, <target_group>, ...
* The forwarder sends all data to the specified groups.
* If you don't want to forward data automatically, don't set this attribute.

That said, as soon as you use the defaultGroup in your outputs.conf Splunk will send all events to the defined group.

Hope that helps to understand the setting ...

cheers, MuS

View solution in original post

0 Karma

MuS
Legend

Hi belasker,

If you read the docs for outputs.conf http://docs.splunk.com/Documentation/Splunk/latest/Admin/Outputsconf you will find this:

defaultGroup = <target_group>, <target_group>, ...
* The forwarder sends all data to the specified groups.
* If you don't want to forward data automatically, don't set this attribute.

That said, as soon as you use the defaultGroup in your outputs.conf Splunk will send all events to the defined group.

Hope that helps to understand the setting ...

cheers, MuS

0 Karma

belasker
New Member

Thank you but In splunk official documentation (last example) they said " All other events get routed to the default group, everythingElseGroup" that means syslogGroup and errorGroup will be forwarded to the right place not the defaultgroup.

0 Karma
Get Updates on the Splunk Community!

Demo Day: Strengthen Your SOC with Splunk Enterprise Security 8.1

Today’s threat landscape is more complex than ever. Security operation centers (SOCs) are overwhelmed with ...

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...