outputs.conf multiple destination, equals, multiple ports?

[Jonson]

Hi all,

Because we have Splunk running in multiple security environments, we have two separate indexer clusters. For some data we need to send data to either both or only one of the indexer clusters.

We do this on the HF by setting the  _TCP_ROUTING key with props.conf & transforms.conf as described in https://docs.splunk.com/Documentation/Splunk/8.0.6/Forwarding/Routeandfilterdatad.  Or by directly setting the _TCP_ROUTING with inputs.conf on the UF. In outputs.conf we configure the two different destinations as in the example below.

We see that in all Splunkdoc examples that different ports are used for different destinations. Is this required for Splunk to function as intended? Or is this only best practice? When do you need to use a different port then 9997 in outputs.conf and when not? This is not clear from the documentation...

Please advice, thanks!

[tcpout]
defaultGroup=everythingElseGroup

[tcpout:syslogGroup]
server=10.1.1.197:9996, 10.1.1.198:9997

[tcpout:errorGroup]
server=10.1.1.200:9999

[tcpout:everythingElseGroup]
server=10.1.1.250:6666

[richgalloway · Accepted solution]

IMO, using different ports is neither necessary nor a best practice.  Since the IP addresses are different there is no need to also change the port.  Port numbers should be different if multiple Splunk instances are running on the same server.

Whenever you find something unclear in the documentation, submit feedback on that page.  The Docs team is excellent about clarifying the docs in response to feedback.