Getting Data In

Unable to find distsearch.conf file on my system and it is causing an error. Are my inputs and outputs configurations correct?

antifreke
Path Finder

I'm having an issue getting the data in my .log files into splunk. I've tested connections, there are no firewall issues and my list-forward returned Active, but not forwarding.

Logs are stored at /var/og/rsyslog/firewall.log

inputs.conf 
[monitor:///var/log/rsyslog/firewall.log]
disabled=false
index=firewall
sourcetype=syslog

outputs.conf
[tcpout]
defaultgroup= indexer
autoLB=true

[tcpout=indexer]
disabled=false
server=x.x.x.20:9997

When I open my splunkd-utility.log, I get a WARN for UserManagerPro - can't [distributedSearch] stanza in distsearch.conf
There is no distsearch.conf file on this system that I can find. Is my error coming from a misconfigured inputs/outputs configuration, or lack of this missing file?

0 Karma

isreis
Explorer

Dear Antifreke,
I usally setup the autoLB=True on the stanza where the indexer is being setup like this:

[tcpout]
defaultgroup= indexer

[tcpout=indexer]
disabled=false
server=x.x.x.20:9997
autoLB=true

For the most recent splunk universal forwarder versions, this parameter is no longer being used, it has been deprecated.

Please see this data below from outputs.conf

https://docs.splunk.com/Documentation/Splunk/6.6.2/Admin/Outputsconf#outputs.conf

----Automatic Load-Balancing

Automatic load balancing is the only way to forward data.

Round-robin method of load balancing is not supported anymore.

autoLBFrequency =
* Every autoLBFrequency seconds, a new indexer is selected randomly from the
list of indexers provided in the server attribute of the target group
stanza.
* Defaults to 30 (seconds).

other tool that I am using to troubleshoot the config files is btool, please see here how you can use it

https://docs.splunk.com/Documentation/Splunk/6.6.2/Troubleshooting/Usebtooltotroubleshootconfigurati...

it is very hepfull and you can check for all the stanzas and parameters that was setup.

It can be something like:

./splunk cmd btool distsearch list --debug | more

If I am not wrong the distsearch.conf is created once you setup your indexers in your search head.

I hope this assist you to fix your issue.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...