i read about the _HTTPOUT_ROUTING in outputs.conf at https://docs.splunk.com/Documentation/Splunk/7.1.1/Forwarding/Routeandfilterdatad . Unfortunately, I didn't find anything in the specfiles or any further examples...
Has anyone configured this? Or can anyone give any advice?
transforms_stanza_namemust be unique" this is also a head-banger...unique means not to that config file but to your entire deployment
outputs.confgets configured as normal
Do you mean _TCP_ROUTING? There isn’t an _HTTP_ROUTING that I can find in outputs.conf or inputs.conf documentation, and I can’t find it at the link you gave.
If so, _TCP_ROUTING tells your inputs which stanza in outputs.conf to use. You can specify it per input or at a global level. See inputs.conf documentation for more details.
_TCP_ROUTING = <tcpout_group_name>,<tcpout_group_name>,<tcpout_group_name>, ... * Comma-separated list of tcpout group names. * Using this, you can selectively forward the data to specific indexer(s). * Specify the tcpout group the forwarder should use when forwarding the data. The tcpout group names are defined in outputs.conf with [tcpout:<tcpout_group_name>]. * Defaults to groups specified in "defaultGroup" in [tcpout] stanza in outputs.conf. * To forward data to all tcpout group names that have been defined in outputs.conf, set to '*' (asterisk). * To forward data from the "_internal" index, _TCP_ROUTING must explicitly be set to either "*" or a specific splunktcp target group.
i really meant _HTTPOUT_ROUTING .. it would be awsome to have such a functionality as it could give you much more flexibility as _TCPOUT and _SYSLOG_ROUTING.
I would love to see this and hope is not a documentation failure.
_HTTPOUT_ROUTING mentioned in documentation,
DEST_KEY should be set to _TCP_ROUTING to send events via TCP. It can also be set to _SYSLOG_ROUTING or _HTTPOUT_ROUTING for other output processors. but I am not able to find anything in outputs.conf and transforms.conf.
Looks like documentation error.