Monitoring Splunk

_TCP_ROUTING not exclusive?


I want to add monitoring of a file and have it forwarded to a splunk server separate than my usual indexers. So I added



to my inputs. It's indexing on the server listed in testGroup just fine. BUT it's also still forwarding to my defaultGroup. How can I forward this particular file to just the testGroup, and not defaultGroup?

Tags (1)


Typically you need a default group for that:
Add this to your outputs.conf
disabled = false
indexAndForward = true
"Note: If you want to forward only the data specifically identified in props.conf and transforms.conf, set defaultGroup=nothing."

0 Karma
Get Updates on the Splunk Community!

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...