After disabling a Forwarder, it keeps talking to the receiver

[Stefan]

I had several lightweight forwarders set up, with all of them pointing towards a single Cook Fwd.

Due to a mistake on 1 of the machines (over 190 of them) I wanted to disable forwarding, did so by editing outputs.conf again and restarted.

Communications wouldn't stop, so I started searching for other copies of the file, all were empty.

I then disabled the forwarder through CLI, restarted once again, all to no avail.

After searching for the receiver's IP on the forwarder box, I found it embeded in the outputs.conf that resides inside the search APP. Cleaned it, then restarted.

That did solve the issue for me, but the question is: What gives?

[Genti · Accepted solution]

its hard to tell what went on with your configuration, however it seems that you were not correct when saying:
"I started searching for other copies of the file, all were empty"
Somehow you had multiple outputs.conf files, the one that you deleted and the one that was residing in the search app.

Next time, you might want to run the following command and make life easier for you:

./splunk cmd btool outputs list --debug

This will tell you exactly what output.conf stanzas exist and where they are residing.

[Stefan]

Great tip, thanks !!

I had tried looking for copies of the file using "find outputs.conf".That returned several files but not the specific one inside Search...