we have a client who wants to migrate sending network devices logs from his universal forwarder server from his POC (search head + indexer) servers to our prod indexers.
But when I point the name of the prod indexers on outputs.conf file under /opt/splunkforwarder/etc/system/local/outputs.conf:
outputs.conf: [tcpout:indexers] server=220.127.116.11:9997,18.104.22.168:9997 [tcpout] defaultGroup=s05 [tcpout:S05] server=LOUWEBWPL20S02:9997,LOUWEBWPL20S03:9997 autoLB = true autoLBFrequency = 31 forceTimebasedAutoLB = true useACK = true
The log collection stops on the orginal POC servers as well as on new indexers there is no data coming.
What am I missing here?
My prod indexer servers are :
and their POC indexer servers are :
Why am I unable to do load balancing?
The below change should work for you. I have made 2 corrections.
1. S05 ==> s05 (Upper case 'S' to lower case 'S')
2. defaultGroup=s05 ==> defaultGroup=s05, indexers (This is required to send the same data to both set of indexers)
outputs.conf: [tcpout] defaultGroup=s05, indexers [tcpout:indexers] server=22.214.171.124:9997,126.96.36.199:9997 [tcpout:s05] server=LOUWEBWPL20S02:9997,LOUWEBWPL20S03:9997 autoLB = true autoLBFrequency = 31 forceTimebasedAutoLB = true useACK = true
Above configuration will work, Incase if the above configuration doesn't work, the check the following
1. User IP address for servers incase if DNS resolution creates problem due to firewall
2. Ensure there are no firewall restrictions
3. Ensure port 9997 opens on indexed (receiver side)
Thanks for your time on investigating this issue. You were right on. I forgot to mention two target group as my default group. Also there was a typo in one of the default group S for s.
This assisted me in troubleshooting the matter.
Thanks Again !!