Getting Data In

outputs.conf multiple destination, equals, multiple ports?

Jonson
Engager

Hi all,

Because we have Splunk running in multiple security environments, we have two separate indexer clusters. For some data we need to send data to either both or only one of the indexer clusters.

We do this on the HF by setting the  _TCP_ROUTING key with props.conf & transforms.conf as described in https://docs.splunk.com/Documentation/Splunk/8.0.6/Forwarding/Routeandfilterdatad.  Or by directly setting the _TCP_ROUTING with inputs.conf on the UF. In outputs.conf we configure the two different destinations as in the example below.

We see that in all Splunkdoc examples that different ports are used for different destinations. Is this required for Splunk to function as intended? Or is this only best practice? When do you need to use a different port then 9997 in outputs.conf and when not? This is not clear from the documentation...

Please advice, thanks!

 

[tcpout]
defaultGroup=everythingElseGroup

[tcpout:syslogGroup]
server=10.1.1.197:9996, 10.1.1.198:9997

[tcpout:errorGroup]
server=10.1.1.200:9999

[tcpout:everythingElseGroup]
server=10.1.1.250:6666

 

1 Solution

richgalloway
SplunkTrust
SplunkTrust

IMO, using different ports is neither necessary nor a best practice.  Since the IP addresses are different there is no need to also change the port.  Port numbers should be different if multiple Splunk instances are running on the same server.

Whenever you find something unclear in the documentation, submit feedback on that page.  The Docs team is excellent about clarifying the docs in response to feedback.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

IMO, using different ports is neither necessary nor a best practice.  Since the IP addresses are different there is no need to also change the port.  Port numbers should be different if multiple Splunk instances are running on the same server.

Whenever you find something unclear in the documentation, submit feedback on that page.  The Docs team is excellent about clarifying the docs in response to feedback.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...