TCP ROUTING and Indexer Discovery- How to configure?

[lrodriguez]

Hello everyone! 

In this scenario i have one Heavy forwarder and one indexer cluster (of course the is a Cluster Manager over there). 

The HF have some inputs configured in this way (inputs.conf): 

[mi_input://List_Deployment_State]

index = endpoint
sourcetype = endpoint
_TCP_ROUTING = ixChabelaGroup

And the outputs were configured in this way (outputs.conf): 

[tcpout]
defaultGroup = ixChabelaGroup
defaultGroup = default-autolb-group

[tcpout:ixChabelaGroup]
server = 192.189.2.25:9997

As you can see the TCP_ROUTING is only sending data to one Indexer and we want to balance the data forwarding to the entire cluster. 

My question is: what would it happen if i enable the indexer discovery in the Heavy Forwarder?  as follows: 

[tcpout:idxc-forwarders]

indexerDiscovery = cluster1

useACK=true

[indexer_discovery:cluster1]

master_uri = https://192.189.2.26:8089

pass4SymmKey = MyUnhashedPasswd

There will be a conflict between the indexer discovery and the _tcp_routing declared? 

Or what is the proper way to configure the indexer discovery in my HF?

Thanks in advance for your support. 

[richgalloway · Accepted solution]

It's not clear what will happen if _TCP_ROUTING references a name not in outputs.conf, but probably won't be what you want.  I suggest removing _TCP_ROUTING settings from all inputs.conf files unless there is a need for input-specific routing.  Then the settings in outputs.conf will control how data is sent to the indexers.

[lrodriguez]

What do you think if i keep the two configurations in the same stanza (indexer discovery and _tcp_routing) ?
It will cause any kind of conflict?

[richgalloway]

Indexer discovery and _TCP_ROUTING are not in the same stanza - they're not even in the same files.  Get rid of _TCP_ROUTING.