forward _internal index from deployment server

[ch_goh]

Hi,
I have the following outputs.conf set in deployment server but the _internal index doesn't seem to be forwarded to the Indexer. What do I miss?

outputs.conf

[tcpout]
autoLB=true
autoLBFrequency=30
blockOnCloning=true
compressed=false
connectionTimeout=20
disabled=false>
dropClonedEventsOnQueueFull=5
dropEventsOnQueueFull=-1
forwardedindex.0.whitelist=.*
forwardedindex.1.whitelist=_.*
forwardedindex.2.whitelist=_audit
forwardedindex.filter.disable=false
heartbeatFrequency=30
indexAndForward=false
maxConnectionsPerIndexer=2
maxFailuresPerInterval=2
maxQueueSize=500KB
readTimeout=300
secsInFailureInterval=1
sendCookedData=true
server=165.36.15.217:9997,165.36.15.218:9997
useACK=false
writeTimeout=300

Please help.

Thanks.

[jhupka · Accepted solution]

Can you try changing your forwardedindex.2 line to :

forwardedindex.2.whitelist = (_audit|_internal)

Also, your other forwardedindex lines (0 and 1) are essentially saying any "1-character" or _"1-character" indexes should be forwarded - these are regular expressions defining the index names you want to forward.

Alternatively, can you simplify your outputs.conf? You really only need the entries you want to override compared to what's in etc/system/default/outputs.conf - I noticed a lot of your settings are the same as what's in the default.

So for example you could have the following much simpler version of your outputs.conf that forwards all indexes (and have this located in etc/system/local or an app's default directory's outputs.conf:

[tcpout]
forwardedindex.0.whitelist=.*
forwardedindex.1.blacklist=
forwardedindex.2.whitelist=

[tcpout:splunk]
server=165.36.15.217:9997,165.36.15.218:9997
autoLB=true

[sowings]

Note that the forwardedindex.whitelist.2 entry described above is the default starting with version 5.0.2, I believe.

[ch_goh]

It works. Thanks.