Deployment Architecture

Setting outputs.conf

rangineniarunku
Explorer

I have a doubt here..I want to index data to both sandbox and production. What changes do I need to make here.

[tcpout]
defaultGroup = production

[tcpout:sandbox]
server=ABC:PORT

[tcpout:production]
server=XYZ:PORT
autoLB = true
useACK = false

Tags (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi rangineniarunkumar,
just a little additional information:

  • are sandbox and production indexers?
  • do you want to send some logs to sandbox and some logs to production?

If this is your need, you should see at http://docs.splunk.com/Documentation/Splunk/6.5.2/Forwarding/Routeandfilterdatad where it's described how to configure your outputs.conf and inputs.conf files.

At first sight I see [default group] stanza in your outputs.conf and you should remove it.
In addition you have to insert in all your inputs.conf files stanzas _TCP_ROUTING = sandbox or _TCP_ROUTING = production depending by your logs.
If you want to send the same log to both the indexers you don't need to insert _TCP_ROUTING =

Bye.
Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi rangineniarunkumar,
just a little additional information:

  • are sandbox and production indexers?
  • do you want to send some logs to sandbox and some logs to production?

If this is your need, you should see at http://docs.splunk.com/Documentation/Splunk/6.5.2/Forwarding/Routeandfilterdatad where it's described how to configure your outputs.conf and inputs.conf files.

At first sight I see [default group] stanza in your outputs.conf and you should remove it.
In addition you have to insert in all your inputs.conf files stanzas _TCP_ROUTING = sandbox or _TCP_ROUTING = production depending by your logs.
If you want to send the same log to both the indexers you don't need to insert _TCP_ROUTING =

Bye.
Giuseppe

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...