Archive

Route event data to different target groups issue

belasker
New Member

Hi Splunkers,
here are my 3 configuration files transforms,props,outputs

/// props.conf
[host:firstClient]
TRANSFORMS-routing=apacheWindows

[host:secondClient]
TRANSFORMS-routing=apacheLinux

/// transforms.conf
[apacheWindows]
REGEX= .
DEST_KEY=_TCP_ROUTING
FORMAT=apacheWindows

[apacheLinux]
REGEX= .
DEST_KEY=_TCP_ROUTING
FORMAT=apacheLinux

// outputs.conf
[tcpout]
defaultGroup = default-group

[tcpout:apacheWindows]
server=192.168.1.25:9997

[tcpout:apacheLinux]
server=192.168.1.24:9997

[tcpout:default-group]
server=192.168.1.25:9997

the issue here is when i use default-group all the data will be forwarded to the default-group address even tcpout:apacheLinux
and when i remove default-group from outputs.conf ,data is forwaded correctly to the 2 different indexers

here the example that i have followed in splunk official documentation

/////

[tcpout]
defaultGroup=everythingElseGroup

[tcpout:syslogGroup]
server=10.1.1.197:9996, 10.1.1.198:9997

[tcpout:errorGroup]
server=10.1.1.200:9999

[tcpout:everythingElseGroup]
server=10.1.1.250:6666
syslogGroup and errorGroup receive events according to the rules specified in transforms.conf. All other events get routed to the default group, everythingElseGroup.

//////

Thank you.

Tags (1)
0 Karma
1 Solution

MuS
SplunkTrust
SplunkTrust

Hi belasker,

If you read the docs for outputs.conf http://docs.splunk.com/Documentation/Splunk/latest/Admin/Outputsconf you will find this:

defaultGroup = <target_group>, <target_group>, ...
* The forwarder sends all data to the specified groups.
* If you don't want to forward data automatically, don't set this attribute.

That said, as soon as you use the defaultGroup in your outputs.conf Splunk will send all events to the defined group.

Hope that helps to understand the setting ...

cheers, MuS

View solution in original post

0 Karma

MuS
SplunkTrust
SplunkTrust

Hi belasker,

If you read the docs for outputs.conf http://docs.splunk.com/Documentation/Splunk/latest/Admin/Outputsconf you will find this:

defaultGroup = <target_group>, <target_group>, ...
* The forwarder sends all data to the specified groups.
* If you don't want to forward data automatically, don't set this attribute.

That said, as soon as you use the defaultGroup in your outputs.conf Splunk will send all events to the defined group.

Hope that helps to understand the setting ...

cheers, MuS

View solution in original post

0 Karma

belasker
New Member

Thank you but In splunk official documentation (last example) they said " All other events get routed to the default group, everythingElseGroup" that means syslogGroup and errorGroup will be forwarded to the right place not the defaultgroup.

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!