I have created an outputs.conf on my Indexer. With the following stanza.
[output]
defaultGroup = indexerB
[indexAndForward]
index=true
selectiveIndexing=false
[tcpout:indexerB]
server = 192.168.1.2:9997
This is not having the intended results. I'm expecting all data being sent that particular Splunk Indexer to be forwarded to indexerB on dst port tcp/9997.
This is the only output we see;
--splunk-cooked-mode-v3--
server01234 8089 @ _s2s_capabilities ack=0;compression=0 _raw --splunk-cooked-mode-v3-- server01234
Your input port on the receiver needs to be defined as "splunktcp" not "tcp".