Compressed data from forwarder to indexer

[Eli_Klein]

I'm having some trouble getting this working. I've tried both the regular forwarder as well as the light forwarder. When using the regular forwarder, I get the following error on the server:

9-03-2010 16:04:20.699 ERROR TcpInputProc - Received unrecognized signature --splunk-cooked-mode-v2--

When using the light forwarder, everything appears to be working fine on the client, but no data is making it to the server. There is no established connection on the compressed port on the server either.

If I change back to the uncompressed port, data flows just fine to the indexer.

I have been unable to find any sort of precise instructions for what it takes to configure compressed data. All I can find are the options in the specfiles that turn on compressed data. I'd love to find something that details things step-by-step. Any help would be greatly appreciated.

Thank you!

[Eli_Klein · Accepted solution]

The problem was with the format of my outputs.conf on my forwarders:

BEFORE (forwarder outputs.conf):

 [tcpout] 
 defaultGroup = splunkgroup
 disabled = false

 [tcpout:splunkgroup] 
 server = splunkserver:9998

 [tcpout-server://splunkserver:9998]
 compressed = true

AFTER (forwarder outputs.conf):

 [tcpout] 
 defaultGroup = splunkgroup
 disabled = false

 [tcpout:splunkgroup] 
 server = splunkserver:9998
 compressed = true

Here's my $SPLUNK_HOME/etc/system/local/inputs.conf from my indexer:

 [default]
 host = splunkserver

 [splunktcp://9997]

 [splunktcp://9998]
 compressed = true

This configures a non-compressed listener on 9997 and a compressed listener on 9998. I hope this helps someone else in my situation!

[gkanapathy]

Sounds like you need to enable compression on the indexer side (or enable a separate listening port that has compression enabled and have your forwarder send there).