Getting Data In

Will my outputs.conf edits work to send both compressed and uncompressed outputs from universal forwarder?

dahlberg
New Member

I have a Universal Forwarder (UF) that I'd like to send out both compressed and uncompressed data streams to a single indexer. Would this outputs.conf work:

[tcpout]
defaultGroup = index_cluster, index_cluster2

[tcpout:index_cluster]
autoLBFrequency=60
autoLB=true
useACK=true
compressed=true
server=indexer:9996

[tcpout:index_cluster2]
compressed=false
server=indexer:9997

Also, how would I specify which files/data streams should go out to targetGroup index_cluster and which ones should go out to index_cluster2?

Thanks,
Mike

0 Karma
1 Solution

jkat54
SplunkTrust
SplunkTrust

Yes, they will work this way.

This is saying by default, send to both.

If you want to specify a target specific to an input use _TCP_ROUTING=name of tcpout on you inputs.conf stanza(s)

For example

[monitor::/var/log/logfile]
...
_TCP_ROUTING=index_cluster2

View solution in original post

jkat54
SplunkTrust
SplunkTrust

Yes, they will work this way.

This is saying by default, send to both.

If you want to specify a target specific to an input use _TCP_ROUTING=name of tcpout on you inputs.conf stanza(s)

For example

[monitor::/var/log/logfile]
...
_TCP_ROUTING=index_cluster2

Get Updates on the Splunk Community!

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Splunk Education Goes to Washington | Splunk GovSummit 2024

If you’re in the Washington, D.C. area, this is your opportunity to take your career and Splunk skills to the ...