Getting Data In

Will my outputs.conf edits work to send both compressed and uncompressed outputs from universal forwarder?

dahlberg
New Member

I have a Universal Forwarder (UF) that I'd like to send out both compressed and uncompressed data streams to a single indexer. Would this outputs.conf work:

[tcpout]
defaultGroup = index_cluster, index_cluster2

[tcpout:index_cluster]
autoLBFrequency=60
autoLB=true
useACK=true
compressed=true
server=indexer:9996

[tcpout:index_cluster2]
compressed=false
server=indexer:9997

Also, how would I specify which files/data streams should go out to targetGroup index_cluster and which ones should go out to index_cluster2?

Thanks,
Mike

0 Karma
1 Solution

jkat54
SplunkTrust
SplunkTrust

Yes, they will work this way.

This is saying by default, send to both.

If you want to specify a target specific to an input use _TCP_ROUTING=name of tcpout on you inputs.conf stanza(s)

For example

[monitor::/var/log/logfile]
...
_TCP_ROUTING=index_cluster2

View solution in original post

jkat54
SplunkTrust
SplunkTrust

Yes, they will work this way.

This is saying by default, send to both.

If you want to specify a target specific to an input use _TCP_ROUTING=name of tcpout on you inputs.conf stanza(s)

For example

[monitor::/var/log/logfile]
...
_TCP_ROUTING=index_cluster2

Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...