Getting Data In

"--splunk-cooked-mode-v3-- " in the indexer

Communicator

Splunkers, I am facing this issue of cooked data, I know there are many answers about it and this has been a real pain for many. I have gone through them and none of it is working. Below are my configurations , if anyone of you can point out where the error is

Forwarder - outputs.conf

[tcpout]
defaultGroup = dmc
indexAndForward = false
disabled = false

sendCookedData=false when i uncomment it I don't get any data at all , not even the cooked one

forwardedindex.2.whitelist = test_index

[tcpout:dmc]
server = xx.xx.xx.xx:9997
autoLB = true


Indexer - inputs.conf

[splunktcp://9996]
connection_host = ip

[splunktcp://9997] disabled = 0

[tcp://8097]
connectionhost = dns
index = test
index
sourcetype = genericsingleline

on indexer I am receiving "--splunk-cooked-mode-v3-- " junk data. Also if anyone can then please explain a bit about cooked mode.

0 Karma
1 Solution

Communicator

directed to port 9996 in outputs.conf and created index=test_index on indexer and it solved the issue for me.

View solution in original post

0 Karma

Communicator

directed to port 9996 in outputs.conf and created index=test_index on indexer and it solved the issue for me.

View solution in original post

0 Karma