Getting Data In

Route event data to different target groups issue

belasker
New Member

Hi Splunkers,
here are my 3 configuration files transforms,props,outputs

/// props.conf
[host:firstClient]
TRANSFORMS-routing=apacheWindows

[host:secondClient]
TRANSFORMS-routing=apacheLinux

/// transforms.conf
[apacheWindows]
REGEX= .
DEST_KEY=_TCP_ROUTING
FORMAT=apacheWindows

[apacheLinux]
REGEX= .
DEST_KEY=_TCP_ROUTING
FORMAT=apacheLinux

// outputs.conf
[tcpout]
defaultGroup = default-group

[tcpout:apacheWindows]
server=192.168.1.25:9997

[tcpout:apacheLinux]
server=192.168.1.24:9997

[tcpout:default-group]
server=192.168.1.25:9997

the issue here is when i use default-group all the data will be forwarded to the default-group address even tcpout:apacheLinux
and when i remove default-group from outputs.conf ,data is forwaded correctly to the 2 different indexers

here the example that i have followed in splunk official documentation

/////

[tcpout]
defaultGroup=everythingElseGroup

[tcpout:syslogGroup]
server=10.1.1.197:9996, 10.1.1.198:9997

[tcpout:errorGroup]
server=10.1.1.200:9999

[tcpout:everythingElseGroup]
server=10.1.1.250:6666
syslogGroup and errorGroup receive events according to the rules specified in transforms.conf. All other events get routed to the default group, everythingElseGroup.

//////

Thank you.

Tags (1)
0 Karma
1 Solution

MuS
Legend

Hi belasker,

If you read the docs for outputs.conf http://docs.splunk.com/Documentation/Splunk/latest/Admin/Outputsconf you will find this:

defaultGroup = <target_group>, <target_group>, ...
* The forwarder sends all data to the specified groups.
* If you don't want to forward data automatically, don't set this attribute.

That said, as soon as you use the defaultGroup in your outputs.conf Splunk will send all events to the defined group.

Hope that helps to understand the setting ...

cheers, MuS

View solution in original post

0 Karma

MuS
Legend

Hi belasker,

If you read the docs for outputs.conf http://docs.splunk.com/Documentation/Splunk/latest/Admin/Outputsconf you will find this:

defaultGroup = <target_group>, <target_group>, ...
* The forwarder sends all data to the specified groups.
* If you don't want to forward data automatically, don't set this attribute.

That said, as soon as you use the defaultGroup in your outputs.conf Splunk will send all events to the defined group.

Hope that helps to understand the setting ...

cheers, MuS

0 Karma

belasker
New Member

Thank you but In splunk official documentation (last example) they said " All other events get routed to the default group, everythingElseGroup" that means syslogGroup and errorGroup will be forwarded to the right place not the defaultgroup.

0 Karma
Get Updates on the Splunk Community!

Say goodbye to manually analyzing phishing and malware threats with Splunk Attack ...

In today’s evolving threat landscape, we understand you’re constantly bombarded with phishing and malware ...

AppDynamics is now part of Splunk Ideas

Hello Splunkers, We have exciting news for you! AppDynamics has been added to the Splunk Ideas Portal. Which ...

Advanced Splunk Data Management Strategies

Join us on Wednesday, May 14, 2025, at 11 AM PDT / 2 PM EDT for an exclusive Tech Talk that delves into ...