Deployment Architecture

Setting outputs.conf

rangineniarunku
Explorer

I have a doubt here..I want to index data to both sandbox and production. What changes do I need to make here.

[tcpout]
defaultGroup = production

[tcpout:sandbox]
server=ABC:PORT

[tcpout:production]
server=XYZ:PORT
autoLB = true
useACK = false

Tags (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi rangineniarunkumar,
just a little additional information:

  • are sandbox and production indexers?
  • do you want to send some logs to sandbox and some logs to production?

If this is your need, you should see at http://docs.splunk.com/Documentation/Splunk/6.5.2/Forwarding/Routeandfilterdatad where it's described how to configure your outputs.conf and inputs.conf files.

At first sight I see [default group] stanza in your outputs.conf and you should remove it.
In addition you have to insert in all your inputs.conf files stanzas _TCP_ROUTING = sandbox or _TCP_ROUTING = production depending by your logs.
If you want to send the same log to both the indexers you don't need to insert _TCP_ROUTING =

Bye.
Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi rangineniarunkumar,
just a little additional information:

  • are sandbox and production indexers?
  • do you want to send some logs to sandbox and some logs to production?

If this is your need, you should see at http://docs.splunk.com/Documentation/Splunk/6.5.2/Forwarding/Routeandfilterdatad where it's described how to configure your outputs.conf and inputs.conf files.

At first sight I see [default group] stanza in your outputs.conf and you should remove it.
In addition you have to insert in all your inputs.conf files stanzas _TCP_ROUTING = sandbox or _TCP_ROUTING = production depending by your logs.
If you want to send the same log to both the indexers you don't need to insert _TCP_ROUTING =

Bye.
Giuseppe

Get Updates on the Splunk Community!

Preparing your Splunk Environment for OpenSSL3

The Splunk platform will transition to OpenSSL version 3 in a future release. Actions are required to prepare ...

Unleash Unified Security and Observability with Splunk Cloud Platform

     Now Available on Microsoft AzureThursday, March 27, 2025  |  11AM PST / 2PM EST | Register NowStep boldly ...

Splunk AppDynamics with Cisco Secure Application

Web applications unfortunately present a target rich environment for security vulnerabilities and attacks. ...