Getting Data In

Unable to find distsearch.conf file on my system and it is causing an error. Are my inputs and outputs configurations correct?

Path Finder

I'm having an issue getting the data in my .log files into splunk. I've tested connections, there are no firewall issues and my list-forward returned Active, but not forwarding.

Logs are stored at /var/og/rsyslog/firewall.log


defaultgroup= indexer


When I open my splunkd-utility.log, I get a WARN for UserManagerPro - can't [distributedSearch] stanza in distsearch.conf
There is no distsearch.conf file on this system that I can find. Is my error coming from a misconfigured inputs/outputs configuration, or lack of this missing file?

0 Karma


Dear Antifreke,
I usally setup the autoLB=True on the stanza where the indexer is being setup like this:

defaultgroup= indexer


For the most recent splunk universal forwarder versions, this parameter is no longer being used, it has been deprecated.

Please see this data below from outputs.conf

----Automatic Load-Balancing

Automatic load balancing is the only way to forward data.

Round-robin method of load balancing is not supported anymore.

autoLBFrequency =
* Every autoLBFrequency seconds, a new indexer is selected randomly from the
list of indexers provided in the server attribute of the target group
* Defaults to 30 (seconds).

other tool that I am using to troubleshoot the config files is btool, please see here how you can use it

it is very hepfull and you can check for all the stanzas and parameters that was setup.

It can be something like:

./splunk cmd btool distsearch list --debug | more

If I am not wrong the distsearch.conf is created once you setup your indexers in your search head.

I hope this assist you to fix your issue.

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!