Getting Data In

outputs.conf multiple destination, equals, multiple ports?

Jonson
Engager

Hi all,

Because we have Splunk running in multiple security environments, we have two separate indexer clusters. For some data we need to send data to either both or only one of the indexer clusters.

We do this on the HF by setting the  _TCP_ROUTING key with props.conf & transforms.conf as described in https://docs.splunk.com/Documentation/Splunk/8.0.6/Forwarding/Routeandfilterdatad.  Or by directly setting the _TCP_ROUTING with inputs.conf on the UF. In outputs.conf we configure the two different destinations as in the example below.

We see that in all Splunkdoc examples that different ports are used for different destinations. Is this required for Splunk to function as intended? Or is this only best practice? When do you need to use a different port then 9997 in outputs.conf and when not? This is not clear from the documentation...

Please advice, thanks!

 

[tcpout]
defaultGroup=everythingElseGroup

[tcpout:syslogGroup]
server=10.1.1.197:9996, 10.1.1.198:9997

[tcpout:errorGroup]
server=10.1.1.200:9999

[tcpout:everythingElseGroup]
server=10.1.1.250:6666

 

1 Solution

richgalloway
SplunkTrust
SplunkTrust

IMO, using different ports is neither necessary nor a best practice.  Since the IP addresses are different there is no need to also change the port.  Port numbers should be different if multiple Splunk instances are running on the same server.

Whenever you find something unclear in the documentation, submit feedback on that page.  The Docs team is excellent about clarifying the docs in response to feedback.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

IMO, using different ports is neither necessary nor a best practice.  Since the IP addresses are different there is no need to also change the port.  Port numbers should be different if multiple Splunk instances are running on the same server.

Whenever you find something unclear in the documentation, submit feedback on that page.  The Docs team is excellent about clarifying the docs in response to feedback.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Transform your security operations with Splunk Enterprise Security

Hi Splunk Community, Splunk Platform has set a great foundation for your security operations. With the ...

Splunk Admins and App Developers | Earn a $35 gift card!

Splunk, in collaboration with ESG (Enterprise Strategy Group) by TechTarget, is excited to announce a ...

Enterprise Security Content Update (ESCU) | New Releases

In October, the Splunk Threat Research Team had one release of new security content via the Enterprise ...