- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Can I set _TCP_ROUTING in the default stanza for inputs.conf?
Can I do as below? or do I have to add _TCP_ROUTING to every data input stanza?
inputs.conf
[default]
index = myapp1
_TCP_ROUTING = myservergroup
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Based on my reading of the inputs.conf spec file, you could do this if you wanted. However, why not control this by specifying the default routing group in outputs.conf instead? This seems to be the more natural way to create a "default" forwarding group.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I had been using the default group, but needed an alternative for a few hosts that have defaultGroups set in system/local that route to other splunk servers.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
This didn't work for me. I had to add the _TCP_ROUTING field to each input that I wanted. Also, removed the _TCP_ROUTING from the default stanza.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
nobody knows?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
_TCP_ROUTING in the default stanza should work, but it didn't work for me either.
