Getting Data In

Where do I put the outputs.conf file to disable indexing on my search head?

Communicator

Where do I put the outputs.conf file to disable indexing on my search head? Does this go in /splunk/etc/system/local or in one of the apps on the SH?

[tcpout]
defaultGroup = primary_indexer

[tcpout:primary_indexer]
server = ##.##.###.##:9997

0 Karma
1 Solution

Contributor

Personally I would create a deployment app and push it out where needed.
But if you are only running one machine, you can put it in either place you mention, just be aware in /system/local/ it will overrule anything in the /apps/myapp/local folders.

Cheers

View solution in original post

Contributor

Personally I would create a deployment app and push it out where needed.
But if you are only running one machine, you can put it in either place you mention, just be aware in /system/local/ it will overrule anything in the /apps/myapp/local folders.

Cheers

View solution in original post

Communicator

Forgot to include this in my original.

[indexAndForward]
index = false

0 Karma