Monitoring Splunk

_TCP_ROUTING not exclusive?


I want to add monitoring of a file and have it forwarded to a splunk server separate than my usual indexers. So I added



to my inputs. It's indexing on the server listed in testGroup just fine. BUT it's also still forwarding to my defaultGroup. How can I forward this particular file to just the testGroup, and not defaultGroup?

Tags (1)


Typically you need a default group for that:
Add this to your outputs.conf
disabled = false
indexAndForward = true
"Note: If you want to forward only the data specifically identified in props.conf and transforms.conf, set defaultGroup=nothing."

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!