Deployment Architecture

forwardindex doesn't seem to work

sf_user_199
Path Finder

We have a search head, reporting search head, and a deployment server. I have them configured to send their internal data to our indexers.

The issue we have is that send some, but not all _internal data.

Specific issues:

-reporting search head & search head do not forward their metrics.log file

-deployment server is running the deployment monitor app. When configured to forward all it's data to the indexers, it will send enough information to the indexers so that we can use the 'all forwarders' dashboard, but none of the source or sourcetype information is sent to the indexers.

Here is our outputs.conf:

[tcpout]
defaultGroup = indexers
disabled = false
indexAndForward = 0
forwardindex.0.whitelist= _internal
forwardindex.filter.disable = false

[tcpout:indexers]
server = a,b,c,d,e
autoLB = true

Any suggestions?

1 Solution

sf_user_199
Path Finder

I'm trying this out:

http://splunk-base.splunk.com/answers/10679/how-do-i-enable-the-_internal-index-to-be-forwarded

[monitor://$SPLUNK_HOME/var/log/splunk/]
_TCP_ROUTING = * 
index = _internal

View solution in original post

0 Karma

sf_user_199
Path Finder

I'm trying this out:

http://splunk-base.splunk.com/answers/10679/how-do-i-enable-the-_internal-index-to-be-forwarded

[monitor://$SPLUNK_HOME/var/log/splunk/]
_TCP_ROUTING = * 
index = _internal
0 Karma
Get Updates on the Splunk Community!

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...