Getting Data In
Highlighted

Route data on Heavy Forwarder is not working

Engager

Hi guys I tried hard here and read some docs:
(https://docs.splunk.com/Documentation/Splunk/7.1.0/Admin/Inputsconf)
(https://docs.splunk.com/Documentation/Splunk/7.1.0/Admin/Propsconf)
(https://docs.splunk.com/Documentation/Splunk/7.1.0/Admin/Transformsconf)
(https://docs.splunk.com/Documentation/Splunk/7.1.0/Admin/Outputsconf)
(https://docs.splunk.com/Documentation/Splunk/7.1.0/Forwarding/Forwarddatatothird-partysystemsd)
(https://answers.splunk.com/answers/474297/how-to-route-and-filter-data-on-the-heavy-forwarde.html?ut...)

But I don´t know what I am doing wrong. I just have to send data to different indexers, but my Heavy Forwarder is clonning the data (I need some of data on indexer01 and the other on indexer02).

Here is my inputs.conf (all configs on my Heavy Forwarder)

[splunktcp://9997]

Here is my props.conf

[host::SRVPRD0001]
TRANSFORMS-routing = index01

[host::SRVPRD0002]
TRANSFORMS-routing = index02

[host::SRVPRD0003]
TRANSFORMS-routing = index02

[host::SRVPRD0004]
TRANSFORMS-routing = index02

[host::SRVPRD0005]
TRANSFORMS-routing = index02

Here my transforms.conf

[index01]
REGEX= .
DEST_KEY=_TCP_ROUTING
FORMAT=sendtoidx01

[index02]
REGEX= .
DEST_KEY=_TCP_ROUTING
FORMAT=sendtoidx02

Here my outputs.conf

[default]
indexAndForward=false

[tcpout:sendtoidx01]
disabled=false
server=192.168.1.73:9997

[tcpout:sendtoidx02]
disabled=false
server=192.168.1.72:9997
0 Karma
Highlighted

Re: Route data on Heavy Forwarder is not working

SplunkTrust
SplunkTrust

Any chance that your props stanzas don't match? Everything else looks fine to me...

0 Karma
Highlighted

Re: Route data on Heavy Forwarder is not working

Engager

Hi xpac, I changed the stanza on my props.conf to browser

[browser]
TRANSFORMS-routing = index02

That way all data should flow only to index02, however my heavy forwarder still splits the data.

0 Karma
Highlighted

Re: Route data on Heavy Forwarder is not working

SplunkTrust
SplunkTrust

Mhh, I'd try a splunk btool props list or splunk show config propsto see if the config is actually applied, or if anything is applied after those transforms that might reset the TCPROUTING variable...

0 Karma
Highlighted

Re: Route data on Heavy Forwarder is not working

Engager

I checked my transforms.conf and the two TCPROUTING are from my [index01] and [index02] stanzas

And on my props.conf I can see my transformation applied.

/opt/splunk/etc/apps/hf/local/props.conf [browser]
/opt/splunk/etc/system/default/props.conf ANNOTATEPUNCT = True
/opt/splunk/etc/system/default/props.conf AUTO
KVJSON = true
/opt/splunk/etc/system/default/props.conf BREAK
ONLYBEFORE =
/opt/splunk/etc/system/default/props.conf BREAK
ONLYBEFOREDATE = True
/opt/splunk/etc/system/default/props.conf CHARSET = UTF-8
/opt/splunk/etc/system/default/props.conf DATETIMECONFIG = /etc/datetime.xml
/opt/splunk/etc/system/default/props.conf HEADER
MODE =
/opt/splunk/etc/system/default/props.conf LEARNMODEL = true
/opt/splunk/etc/system/default/props.conf LEARN
SOURCETYPE = true
/opt/splunk/etc/system/default/props.conf LINEBREAKERLOOKBEHIND = 100
/opt/splunk/etc/system/default/props.conf MATCHLIMIT = 100000
/opt/splunk/etc/system/default/props.conf MAX
DAYSAGO = 2000
/opt/splunk/etc/system/default/props.conf MAX
DAYSHENCE = 2
/opt/splunk/etc/system/default/props.conf MAX
DIFFSECSAGO = 3600
/opt/splunk/etc/system/default/props.conf MAXDIFFSECSHENCE = 604800
/opt/splunk/etc/system/default/props.conf MAX
EVENTS = 256
/opt/splunk/etc/system/default/props.conf MAXTIMESTAMPLOOKAHEAD = 128
/opt/splunk/etc/system/default/props.conf MUSTBREAKAFTER =
/opt/splunk/etc/system/default/props.conf MUSTNOTBREAKAFTER =
/opt/splunk/etc/system/default/props.conf MUST
NOTBREAKBEFORE =
/opt/splunk/etc/system/default/props.conf SEGMENTATION = indexing
/opt/splunk/etc/system/default/props.conf SEGMENTATION-all = full
/opt/splunk/etc/system/default/props.conf SEGMENTATION-inner = inner
/opt/splunk/etc/system/default/props.conf SEGMENTATION-outer = outer
/opt/splunk/etc/system/default/props.conf SEGMENTATION-raw = none
/opt/splunk/etc/system/default/props.conf SEGMENTATION-standard = standard
/opt/splunk/etc/system/default/props.conf SHOULDLINEMERGE = True
/opt/splunk/etc/system/default/props.conf TRANSFORMS =
/opt/splunk/etc/apps/hf/local/props.conf TRANSFORMS-routing = index02
/opt/splunk/etc/system/default/props.conf TRUNCATE = 10000
/opt/splunk/etc/system/default/props.conf detect
trailing_nulls = false
/opt/splunk/etc/system/default/props.conf maxDist = 100
/opt/splunk/etc/system/default/props.conf priority =
/opt/splunk/etc/system/default/props.conf sourcetype =

0 Karma