Getting Data In

[syslog] TCP stops normal [tcpout]

robf
Path Finder

I have [tcpout] configured as below and is working fine. However i now have a requirement to syslog one sourcetype to another server. unfortunately when i add the [syslog] stanza and atributes as below and restart service, the syslog starts working but the standard tcpout stops forwarding to my indexers

any idea why? how to trouble shoot? i would like both working

outputs.conf

[tcpout]
defaultGroup = default-autolb-group
disabled = false

[tcpout:default-autolb-group]
autoLB = true
disabled = false
server = indexer1:9997,indexer2:9997
useACK = true
maxQueueSize = 100MB

[syslog]
defaultGroup = teamb

[syslog:teamb]
server = 10.0.0.2:514
type  = tcp
syslogSourcetype = sourcetype::proxylogs
0 Karma

yannK
Splunk Employee
Splunk Employee

do not use defaultGroup for syslog, use directly

`
[syslog]
server = 10.0.0.2:514
type = tcp
syslogSourcetype = sourcetype::proxylogs

`
if you have multiple syslogs, use a different name, like [syslog-teamb]

0 Karma

robf
Path Finder

looks like key error is

05-30-2012 10:44:54.699 -0400 INFO TailingProcessor - Could not send data to output queue (parsingQueue), retrying....

this is a heavy forwarder.

0 Karma

robf
Path Finder

05-30-2012 10:44:54.699 -0400 INFO TailingProcessor - Could not send data to output queue (parsingQueue), retrying...
05-30-2012 10:45:48.358 -0400 INFO TcpOutputProc - Connected to idx=:9997 using ACK.
05-30-2012 10:46:18.394 -0400 INFO TcpOutputProc - Connected to idx=:9997 using ACK.

0 Karma

Drainy
Champion

Are there any mesages in the Splunkd.log? Also, what happens if you change Syslog over to use UDP? What sort of setup do you have? (Is this a heavy forwarder, light-weight or UF?)

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Take Action Automatically on Splunk Alerts with Red Hat Ansible Automation Platform

 Are you ready to revolutionize your IT operations? As digital transformation accelerates, the demand for ...

Calling All Security Pros: Ready to Race Through Boston?

Hey Splunkers, .conf25 is heading to Boston and we’re kicking things off with something bold, competitive, and ...

Beyond Detection: How Splunk and Cisco Integrated Security Platforms Transform ...

Financial services organizations face an impossible equation: maintain 99.9% uptime for mission-critical ...