Getting Data In

[syslog] TCP stops normal [tcpout]

robf
Path Finder

I have [tcpout] configured as below and is working fine. However i now have a requirement to syslog one sourcetype to another server. unfortunately when i add the [syslog] stanza and atributes as below and restart service, the syslog starts working but the standard tcpout stops forwarding to my indexers

any idea why? how to trouble shoot? i would like both working

outputs.conf

[tcpout]
defaultGroup = default-autolb-group
disabled = false

[tcpout:default-autolb-group]
autoLB = true
disabled = false
server = indexer1:9997,indexer2:9997
useACK = true
maxQueueSize = 100MB

[syslog]
defaultGroup = teamb

[syslog:teamb]
server = 10.0.0.2:514
type  = tcp
syslogSourcetype = sourcetype::proxylogs
0 Karma

yannK
Splunk Employee
Splunk Employee

do not use defaultGroup for syslog, use directly

`
[syslog]
server = 10.0.0.2:514
type = tcp
syslogSourcetype = sourcetype::proxylogs

`
if you have multiple syslogs, use a different name, like [syslog-teamb]

0 Karma

robf
Path Finder

looks like key error is

05-30-2012 10:44:54.699 -0400 INFO TailingProcessor - Could not send data to output queue (parsingQueue), retrying....

this is a heavy forwarder.

0 Karma

robf
Path Finder

05-30-2012 10:44:54.699 -0400 INFO TailingProcessor - Could not send data to output queue (parsingQueue), retrying...
05-30-2012 10:45:48.358 -0400 INFO TcpOutputProc - Connected to idx=:9997 using ACK.
05-30-2012 10:46:18.394 -0400 INFO TcpOutputProc - Connected to idx=:9997 using ACK.

0 Karma

Drainy
Champion

Are there any mesages in the Splunkd.log? Also, what happens if you change Syslog over to use UDP? What sort of setup do you have? (Is this a heavy forwarder, light-weight or UF?)

0 Karma
Get Updates on the Splunk Community!

Enterprise Security (ES) Essentials 8.3 is Now GA — Smarter Detections, Faster ...

As of today, Enterprise Security (ES) Essentials 8.3 is now generally available, helping SOC teams simplify ...

AI for AppInspect

We’re excited to announce two new updates to AppInspect designed to save you time and make the app approval ...

App Platform's 2025 Year in Review: A Year of Innovation, Growth, and Community

As we step into 2026, it’s the perfect moment to reflect on what an extraordinary year 2025 was for the Splunk ...