Getting Data In

Encountered the following error while trying to save: In handler 'tcpout-server': servername:9997, servername:9997, servername:9997, servername:9997, specified in incorrect format. Please specify in : form

shandman
Path Finder

I am trying to "Add new" in Forwarding and Receiving / Forward data. I simply want to add my Load Balanced Indexers, but it will not save / rather get the above error message. I know I can probably just edit the outputs.conf manually, but I don't understand why this won't work.
Ideas?

1 Solution

MuS
SplunkTrust
SplunkTrust

Hi shandman,

Just trust the UI like it said Enter host:port to forward data to. Data will be auto load balanced to each host:port. So if you want to add multiple servers, just add one by one and you will get an outputs.conf like this:

[tcpout]
defaultGroup = default-autolb-group

[tcpout-server://servername:9997]

[tcpout:default-autolb-group]
disabled = false
server = servername:9997,servername1:9997

[tcpout-server://servername1:9997]

I added first servername:9997 saved and added servername1:9997 as second.

Hope that helps ...

cheers, MuS

View solution in original post

MuS
SplunkTrust
SplunkTrust

Hi shandman,

Just trust the UI like it said Enter host:port to forward data to. Data will be auto load balanced to each host:port. So if you want to add multiple servers, just add one by one and you will get an outputs.conf like this:

[tcpout]
defaultGroup = default-autolb-group

[tcpout-server://servername:9997]

[tcpout:default-autolb-group]
disabled = false
server = servername:9997,servername1:9997

[tcpout-server://servername1:9997]

I added first servername:9997 saved and added servername1:9997 as second.

Hope that helps ...

cheers, MuS

shandman
Path Finder

Oh wow! Nice. The description in the documentation made it sound like you could enter them all in one go, separated by comma's. This makes sense. TY!!

0 Karma

shandman
Path Finder

Can anyone help with this?

0 Karma
Get Updates on the Splunk Community!

Unlock Database Monitoring with Splunk Observability Cloud

  In today’s fast-paced digital landscape, even minor database slowdowns can disrupt user experiences and ...

Purpose in Action: How Splunk Is Helping Power an Inclusive Future for All

At Cisco, purpose isn’t a tagline—it’s a commitment. Cisco’s FY25 Purpose Report outlines how the company is ...

[Upcoming Webinar] Demo Day: Transforming IT Operations with Splunk

Join us for a live Demo Day at the Cisco Store on January 21st 10:00am - 11:00am PST In the fast-paced world ...