Splunk forward data not sending to multiple splunk receiver

[dhirendra761]

Hi All,

In my Splunk forwarder, we were monitoring data and forwarding in one splunk instance, Now I need to add one more receiver in forwarder. 1 forwarder 2 receivers.

I did as below but after config, I am not getting any indexed data, even first splunk instances stop received any data.
below is my config files for input.conf and out.conf for Splunk Forwarder:

input.conf

# first splunk instance
[WinHostMon://Service]
 _TCP_ROUTING = default-autolb-group
type = service
interval = 300
disabled = 0
index = index_logs

# second splunk instance

[monitor://D:\SATS\SecureLog\*\Logs_Status\*]
 _TCP_ROUTING = default-autolb-group2
disabled = 0
index = index-stats
sourcetype = index:stats:gl
crcSalt = <SOURCE>

output.conf

[tcpout]
defaultGroup = default-autolb-group, default-autolb-group2

[tcpout:default-autolb-group]
server = xxx.xx.xx.xxx:9997

[tcpout-server://xxx.xx.xx.xxx:9997]

[tcpout:default-autolb-group2]
server = yy.yy.yyy.yyy:9997
[tcpout-server://yy.yy.yyy.yyy:9997]

Please suggest. Thanks in advance.
-dhirendra

[harish_l]

[tcpout:Indexer1]
server = xxx.xxx.xxx.xxx:9997
disabled = false
[tcpout-server://xxx.xxx.xxx.xxx:9997]

[tcpout:Indexer2]
server=yyy.yyy.yyy.yyy:9997
disabled = false
[tcpout-server://yyy.yyy.yyy.yyy:9997]

If you want to forward logs to both the Indexers it's sufficient to use this outputs.conf, if you want selectively send some logs to one Indexer and other to the second, you have to insert in each stanza of your inputs.conf _TCP_ROUTING = ,,, ...

See http://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Routeandfilterdatad

[vinod94]

hi dyude @dhirendra761 ,

its inputs.conf and outputs.conf, you can check the spelling. if it's proper then you can give this a shot...

outputs.conf

[tcpout:Group1]
server=server1:9997

[tcpout:Group2]
server=server2:9997

inputs.conf

[WinHostMon://Service]
_TCP_ROUTING = Group1

[monitor://D:\SATS\SecureLog\*\Logs_Status\*]
_TCP_ROUTING = Group2