Monitoring Splunk

_TCP_ROUTING not exclusive?

dmesler
Explorer

I want to add monitoring of a file and have it forwarded to a splunk server separate than my usual indexers. So I added

[monitor:///new/file]

_TCP_ROUTING=testGroup

to my inputs. It's indexing on the server listed in testGroup just fine. BUT it's also still forwarding to my defaultGroup. How can I forward this particular file to just the testGroup, and not defaultGroup?

Tags (1)

chicodeme
Communicator

Typically you need a default group for that:
Add this to your outputs.conf
[tcpout]
defaultGroup=nothing
disabled = false
indexAndForward = true

http://docs.splunk.com/Documentation/Splunk/4.3.1/Deploy/Forwarddatatothird-partysystemsd
"Note: If you want to forward only the data specifically identified in props.conf and transforms.conf, set defaultGroup=nothing."

0 Karma
Get Updates on the Splunk Community!

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...