Getting Data In

Unable to find distsearch.conf file on my system and it is causing an error. Are my inputs and outputs configurations correct?

Path Finder

I'm having an issue getting the data in my .log files into splunk. I've tested connections, there are no firewall issues and my list-forward returned Active, but not forwarding.

Logs are stored at /var/og/rsyslog/firewall.log

inputs.conf 
[monitor:///var/log/rsyslog/firewall.log]
disabled=false
index=firewall
sourcetype=syslog

outputs.conf
[tcpout]
defaultgroup= indexer
autoLB=true

[tcpout=indexer]
disabled=false
server=x.x.x.20:9997

When I open my splunkd-utility.log, I get a WARN for UserManagerPro - can't [distributedSearch] stanza in distsearch.conf
There is no distsearch.conf file on this system that I can find. Is my error coming from a misconfigured inputs/outputs configuration, or lack of this missing file?

0 Karma

Explorer

Dear Antifreke,
I usally setup the autoLB=True on the stanza where the indexer is being setup like this:

[tcpout]
defaultgroup= indexer

[tcpout=indexer]
disabled=false
server=x.x.x.20:9997
autoLB=true

For the most recent splunk universal forwarder versions, this parameter is no longer being used, it has been deprecated.

Please see this data below from outputs.conf

https://docs.splunk.com/Documentation/Splunk/6.6.2/Admin/Outputsconf#outputs.conf

----Automatic Load-Balancing

Automatic load balancing is the only way to forward data.

Round-robin method of load balancing is not supported anymore.

autoLBFrequency =
* Every autoLBFrequency seconds, a new indexer is selected randomly from the
list of indexers provided in the server attribute of the target group
stanza.
* Defaults to 30 (seconds).

other tool that I am using to troubleshoot the config files is btool, please see here how you can use it

https://docs.splunk.com/Documentation/Splunk/6.6.2/Troubleshooting/Usebtooltotroubleshootconfigurati...

it is very hepfull and you can check for all the stanzas and parameters that was setup.

It can be something like:

./splunk cmd btool distsearch list --debug | more

If I am not wrong the distsearch.conf is created once you setup your indexers in your search head.

I hope this assist you to fix your issue.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!