Getting Data In

How to forward data from one Splunk indexer to another indexer?

gekoner
Communicator

I have created an outputs.conf on my Indexer. With the following stanza.

[output]
defaultGroup = indexerB

[indexAndForward]
index=true
selectiveIndexing=false

[tcpout:indexerB]
server = 192.168.1.2:9997

This is not having the intended results. I'm expecting all data being sent that particular Splunk Indexer to be forwarded to indexerB on dst port tcp/9997.
This is the only output we see;
--splunk-cooked-mode-v3--
server01234 8089 @ _s2s_capabilities ack=0;compression=0 _raw --splunk-cooked-mode-v3-- server01234

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

Your input port on the receiver needs to be defined as "splunktcp" not "tcp".

0 Karma
Get Updates on the Splunk Community!

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer at Splunk .conf24 ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...

Share Your Ideas & Meet the Lantern team at .Conf! Plus All of This Month’s New ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...