Monitoring Splunk

_TCP_ROUTING not exclusive?

dmesler
Explorer

I want to add monitoring of a file and have it forwarded to a splunk server separate than my usual indexers. So I added

[monitor:///new/file]

_TCP_ROUTING=testGroup

to my inputs. It's indexing on the server listed in testGroup just fine. BUT it's also still forwarding to my defaultGroup. How can I forward this particular file to just the testGroup, and not defaultGroup?

Tags (1)

chicodeme
Communicator

Typically you need a default group for that:
Add this to your outputs.conf
[tcpout]
defaultGroup=nothing
disabled = false
indexAndForward = true

http://docs.splunk.com/Documentation/Splunk/4.3.1/Deploy/Forwarddatatothird-partysystemsd
"Note: If you want to forward only the data specifically identified in props.conf and transforms.conf, set defaultGroup=nothing."

0 Karma
Get Updates on the Splunk Community!

Accelerating Observability as Code with the Splunk AI Assistant

We’ve seen in previous posts what Observability as Code (OaC) is and how it’s now essential for managing ...

Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...

 Splunk is More Than Just the Web Console For Digital Forensics and Incident Response (DFIR) practitioners, ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...