Getting Data In

ForwarderInfo log events after upgrader to 5.0.1

tlabue
Path Finder

After we upgraded from 4.3.4 to 5.0.1, in out Splunk output streams we started receiving the following unwanted events:

ForwardInfo build=143156 version=5.0.1 os=Linux arch=x86_64 hostname=<serverName> guid=A5E34FA-C8AC-4A52-A59B-5660FDA25F94 fwdType=full ssl=false lastIndexer=None

We are sending the output streams to another application which packages them for delivery to a Splunk instance on another isolated network.

Here are some snippets from our outputs.conf

[tcpout]
indexAndForward = true
defaultGroup = nothing

[tcp:nothing]
disabled = false
server = <false server name>
dropEventsonQueueFull = 1

[tcp:server1]
server = appserver1:port, appserver2:port
autoLBFrequency = 88
sendCookedData = false
heartbeatFrequency = 0

[tcp:server2]
....

This allows outputs events by server and allows us to keep this data separated into different files for events coming from different servers.

We have tried some other permutations:
a. Removing the defaultGroup
This removed the ForwarderInfo messages, but added audit log messages, which were more frequent
b. Remove the defaultGroup and add whitelist and blacklist to the tcpout stanza

forwaderindex.0.whitelist = .*
forwaderindex.1.blacklist = _.*
forwaderindex.2.whitelist = _whatever

This removed the audit logs and ForwardInfo events, but now all log events went to each output file, which is not what we are looking for either.

Anyone have any idea on removing the ForwarderInfo without adding anything to the stream?

0 Karma
1 Solution

tlabue
Path Finder

We found out by setting by disabling the default tcp stanza, we stopped getting the ForwarderInfo lines.

[tcp:nothing]
disabled = true
server =
dropEventsonQueueFull = 1

View solution in original post

0 Karma

tlabue
Path Finder

We found out by setting by disabling the default tcp stanza, we stopped getting the ForwarderInfo lines.

[tcp:nothing]
disabled = true
server =
dropEventsonQueueFull = 1

0 Karma
Get Updates on the Splunk Community!

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...