Getting Data In

Why is output stopping all outputs routing when a 3rd party server goes down?

Path Finder


I am getting a weird issue. If the syslog server fails, it stops all data being indexed by the default TCP out, and then Splunk fills its buckets and falls over. Am I missing something to set it to continue if it can't connect to a output.

cat outputs.conf


defaultGroup = xxxxx_indexers


server =

type = tcp

timestampformat = %Y-%m-%dT%T.%S

cat transforms.conf




FORMAT = xxx_cluster_indexers


SOURCE_KEY = MetaData:Sourcetype

REGEX = (fgt_traffic|fgt_utm)


FORMAT = xxxx_indexers

cat props.conf


TRANSFORMS-routing = mehRouting, Routing_firewalls


TRANSFORMS-routing = mehRouting, Routing_firewalls

0 Karma

Ultra Champion

Hi @lukessi,

Can you please provide your full configuration from outputs.conf because I can't see xxx_cluster_indexers in your outputs.conf

0 Karma

Path Finder

confirmed if I loss the 3rd party syslog, it stops forwarding to our indexers as well.

0 Karma

Ultra Champion

Based on answer , it looks like known issue when you'll send data to syslog over TCP. Splunk stops sending data to indexers as well when syslog server is down, better to switch it to UDP or raise case with splunk support.

0 Karma

Path Finder

Ah yes its picked up from the default index app we have...


useACK = true

defaultGroup = xxx_cluster_indexers

disabled = false


server = index1:9997,index2:9997

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...