Splunk forwarding, need information about a stanza in inputs.conf

[somesoni2]

Hi,

I am trying to setup forwarding on my Splunk instance and need information about the following stanza in etc/system/local/inputs.conf.

[splunktcp://9997]
connection_host = none

1. What does this stanza is really used for? (not very clear with documentation)
2. If I am trying to setup index and forward, does this stanza play any role in that? Currently I don't have this stanza in my inputs.conf and its failing.

Appreciate your help here.

[lukejadamec · Accepted solution]

On occasion you may experience all of your forwarders dropping off-line.
The stanza you mentioned fixes the problem.

How it works, no one really knows.... Well, some folks do. Looks like a DNS issue.

http://answers.splunk.com/answers/49833/splunk-forwarder-connection-refused-from-splunk-indexer

http://answers.splunk.com/answers/43259/intermediate-forwarder-connections-timeout