Hello All, We need help on below issue?
while we are routing data 2 different indexer groups using TCPROUTING in inputs.conf and when one group is down data didnot forwarded to second group of indexers? Is this expected?
Please provide your inputs if you have any similar issue or know how to handle this case.
If you are using cloned groups.The default is to stop all forwarding as soon as one group is not accepting data.
Check for settings in outputs.conf like blockOnCloning
For syslog routing it's also stopping as soon at splunktcp or syslog are blocked.
For TCPROUTING I am not sure of the behavior , it may be the same