Getting Data In

_TCP_ROUTING with clustered indexers system logs

splunkreal
Motivator

Hello,

we have 2 Splunk platforms and we are using _TCP_ROUTING to forward logs.

System logs from 1st platform indexers are currently logged on themself.

 

We want to also receive system logs from  indexers of the 1st platform on our 2nd platform however there is no default tcpout group on 1st platform indexers.

 

So should we create default outputs.conf on 1st platform indexers to continue indexing local system logs?

 

Thanks for your help.

 

* If this helps, please upvote or accept solution if it solved *
Labels (4)
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...