Getting Data In

_TCP_ROUTING with clustered indexers system logs

splunkreal
Motivator

Hello,

we have 2 Splunk platforms and we are using _TCP_ROUTING to forward logs.

System logs from 1st platform indexers are currently logged on themself.

 

We want to also receive system logs from  indexers of the 1st platform on our 2nd platform however there is no default tcpout group on 1st platform indexers.

 

So should we create default outputs.conf on 1st platform indexers to continue indexing local system logs?

 

Thanks for your help.

 

* If this helps, please upvote or accept solution if it solved *
Labels (4)
0 Karma

tej57
Contributor

Hello @splunkreal,

Yes, you'll need to define the outputs.conf on Indexers1 to forward the logs to indexers2. If you wish to send all the logs of indexers1 to indexers2, you can definitely use the defaultGroup parameter in outputs.conf. However, if you wish to send only a few logs from indexers1 to indexers2, it would be better to use _TCP_ROUTING in inputs.conf for those particular inputs.

 

Thanks,
Tejas.

---

If the above solution helps, an upvote is appreciated..!! 

0 Karma
Get Updates on the Splunk Community!

Index This | What did the zero say to the eight?

June 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

Splunk Observability Cloud's AI Assistant in Action Series: Onboarding New Hires & ...

This is the fifth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Now Playing: Splunk Education Summer Learning Premieres

It’s premiere season, and Splunk Education is rolling out new releases you won’t want to miss. Whether you’re ...