Getting Data In

Can I set _TCP_ROUTING in the default stanza for inputs.conf?

juniormint
Communicator

Can I do as below? or do I have to add _TCP_ROUTING to every data input stanza?

inputs.conf

[default]
index = myapp1
_TCP_ROUTING = myservergroup
Tags (3)
0 Karma

BenjaminWyatt
Communicator

Based on my reading of the inputs.conf spec file, you could do this if you wanted. However, why not control this by specifying the default routing group in outputs.conf instead? This seems to be the more natural way to create a "default" forwarding group.

0 Karma

juniormint
Communicator

I had been using the default group, but needed an alternative for a few hosts that have defaultGroups set in system/local that route to other splunk servers.

0 Karma

juniormint
Communicator

This didn't work for me. I had to add the _TCP_ROUTING field to each input that I wanted. Also, removed the _TCP_ROUTING from the default stanza.

0 Karma

juniormint
Communicator

nobody knows?

0 Karma

anwarmmian
Explorer

_TCP_ROUTING in the default stanza should work, but it didn't work for me either.

0 Karma
Get Updates on the Splunk Community!

Data Management Digest – December 2025

Welcome to the December edition of Data Management Digest! As we continue our journey of data innovation, the ...

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...