Getting Data In

Intermediate forwarder not forwarding _internal data

Path Finder

I am using Universal Forwarder as Intermediate forwarder, it is forwarding the monitored data without any issues but it is not forwarding any data _internal index or Splunk logs.

Intermediate Forwarder Configuration:
Outputs.conf
[tcpout:index]
server=sra-index-01:9997,sra-index-02:9997,sra-index-03:9997,sra-index-04:9997,sra-index-05:9997

inputs.conf
[splunktcp://9997]
disabled=0

1 Solution

Splunk Employee
Splunk Employee

[tcpout]
forwardedindex.filter.disable = true

View solution in original post

Splunk Employee
Splunk Employee

[tcpout]
forwardedindex.filter.disable = true

View solution in original post

Path Finder

Thanks dmaislin, it worked.

0 Karma

Path Finder

Worked for me as well.

0 Karma