Getting Data In

Can I set _TCP_ROUTING in the default stanza for inputs.conf?

Communicator

Can I do as below? or do I have to add TCPROUTING to every data input stanza?

inputs.conf

[default]
index = myapp1
_TCP_ROUTING = myservergroup
Tags (3)
0 Karma

Communicator

Based on my reading of the inputs.conf spec file, you could do this if you wanted. However, why not control this by specifying the default routing group in outputs.conf instead? This seems to be the more natural way to create a "default" forwarding group.

0 Karma

Communicator

I had been using the default group, but needed an alternative for a few hosts that have defaultGroups set in system/local that route to other splunk servers.

0 Karma

Communicator

This didn't work for me. I had to add the TCPROUTING field to each input that I wanted. Also, removed the TCPROUTING from the default stanza.

0 Karma

Communicator

nobody knows?

0 Karma