Getting Data In

outputs.conf multiple destination, equals, multiple ports?

Engager

Hi all,

Because we have Splunk running in multiple security environments, we have two separate indexer clusters. For some data we need to send data to either both or only one of the indexer clusters.

We do this on the HF by setting the  _TCP_ROUTING key with props.conf & transforms.conf as described in https://docs.splunk.com/Documentation/Splunk/8.0.6/Forwarding/Routeandfilterdatad.  Or by directly setting the _TCP_ROUTING with inputs.conf on the UF. In outputs.conf we configure the two different destinations as in the example below.

We see that in all Splunkdoc examples that different ports are used for different destinations. Is this required for Splunk to function as intended? Or is this only best practice? When do you need to use a different port then 9997 in outputs.conf and when not? This is not clear from the documentation...

Please advice, thanks!

 

[tcpout]
defaultGroup=everythingElseGroup

[tcpout:syslogGroup]
server=10.1.1.197:9996, 10.1.1.198:9997

[tcpout:errorGroup]
server=10.1.1.200:9999

[tcpout:everythingElseGroup]
server=10.1.1.250:6666

 

1 Solution

SplunkTrust
SplunkTrust

IMO, using different ports is neither necessary nor a best practice.  Since the IP addresses are different there is no need to also change the port.  Port numbers should be different if multiple Splunk instances are running on the same server.

Whenever you find something unclear in the documentation, submit feedback on that page.  The Docs team is excellent about clarifying the docs in response to feedback.

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

SplunkTrust
SplunkTrust

IMO, using different ports is neither necessary nor a best practice.  Since the IP addresses are different there is no need to also change the port.  Port numbers should be different if multiple Splunk instances are running on the same server.

Whenever you find something unclear in the documentation, submit feedback on that page.  The Docs team is excellent about clarifying the docs in response to feedback.

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!