How to forward internal logs from the Master Node to Indexers?

[ishaanshekhar]

Dear SPLUNK Community,

I need to send the internal logs from Master Node to the Indexers so that it can be viewed by the Search Heads.

Here is my outputs.conf:

[indexAndForward]
index = false

[tcpout]
defaultGroup=indexer_group1
forwardedindex.filter.disable = true
indexAndForward=false

[tcpout:indexer_group1]
autoLBFrequency=40
server=Ind1:9997,Ind2:9997,Ind3:9997

Q1) Should I place this in $SPLUNK_HOME/etc/system/local/ ,or can I also place it in $SPLUNK_HOME/etc/apps/push_internal_data_app/local/ ?

Q2) Do I need to restart the Master Node? If yes, then what is the ideal way to restart the master in this scenario?

Thanks in advance!!
Ishaan

[somesoni2 · Accepted solution]

1) You can place in any of those locations, I would prefer putting it in push_internal_data_app.
2) You would need to restart Splunk instance for outputs.conf to take effect. See this link for recommendations/details on Cluster master restart.
http://docs.splunk.com/Documentation/Splunk/6.0/Indexer/Whathappenswhenamasternodegoesdown