Archive
Highlighted

Why data is not been routing to second group when we have issue with first group of indexers?

New Member

Hello All, We need help on below issue?

while we are routing data 2 different indexer groups using TCPROUTING in inputs.conf and when one group is down data didnot forwarded to second group of indexers? Is this expected?

Please provide your inputs if you have any similar issue or know how to handle this case.

Thanks

Tags (1)
0 Karma
Highlighted

Re: Why data is not been routing to second group when we have issue with first group of indexers?

Ultra Champion

If you are using cloned groups.The default is to stop all forwarding as soon as one group is not accepting data.
Check for settings in outputs.conf like blockOnCloning
http://docs.splunk.com/Documentation/Splunk/latest/Admin/Outputsconf

For syslog routing it's also stopping as soon at splunktcp or syslog are blocked.
For TCPROUTING I am not sure of the behavior , it may be the same

0 Karma