Getting Data In

outputs.conf multiple destination, equals, multiple ports?

Jonson
Engager

Hi all,

Because we have Splunk running in multiple security environments, we have two separate indexer clusters. For some data we need to send data to either both or only one of the indexer clusters.

We do this on the HF by setting the  _TCP_ROUTING key with props.conf & transforms.conf as described in https://docs.splunk.com/Documentation/Splunk/8.0.6/Forwarding/Routeandfilterdatad.  Or by directly setting the _TCP_ROUTING with inputs.conf on the UF. In outputs.conf we configure the two different destinations as in the example below.

We see that in all Splunkdoc examples that different ports are used for different destinations. Is this required for Splunk to function as intended? Or is this only best practice? When do you need to use a different port then 9997 in outputs.conf and when not? This is not clear from the documentation...

Please advice, thanks!

 

[tcpout]
defaultGroup=everythingElseGroup

[tcpout:syslogGroup]
server=10.1.1.197:9996, 10.1.1.198:9997

[tcpout:errorGroup]
server=10.1.1.200:9999

[tcpout:everythingElseGroup]
server=10.1.1.250:6666

 

1 Solution

richgalloway
SplunkTrust
SplunkTrust

IMO, using different ports is neither necessary nor a best practice.  Since the IP addresses are different there is no need to also change the port.  Port numbers should be different if multiple Splunk instances are running on the same server.

Whenever you find something unclear in the documentation, submit feedback on that page.  The Docs team is excellent about clarifying the docs in response to feedback.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

IMO, using different ports is neither necessary nor a best practice.  Since the IP addresses are different there is no need to also change the port.  Port numbers should be different if multiple Splunk instances are running on the same server.

Whenever you find something unclear in the documentation, submit feedback on that page.  The Docs team is excellent about clarifying the docs in response to feedback.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk Life | Splunk is Officially Part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint. Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...