Configuration for TCP input and TCP Output

[NReddy12]

We have configured inputs.conf with tcp to fetch the logs from streaming and send logs to Splunk server via TCP output. Logs are not being forwarded to Splunk server.

Could someone please share the proper set of inputs.conf and outputs.conf for reading the logs from TCP inputs ?

inputs.conf

[tcp://1.2.3.4:7514]
connection_host=ip
queueSize=10MB
persistentQueueSize=50MB
index=test_data
sourcetype=testdata
_TCP_ROUTING=ib_group

outputs.conf

[tcpout:ib_group]
server=1.2.3.4:9997
useACK=false

[NReddy12]

@JohnEGones, I have created Splunk Indexer and Splunk UF using docker-compose files. Both are running on the same host. We are able to forward the logs if we configure file monitoring in inputs.conf. But when I tried reading the data logs from TCP input, the data is not going to Indexer.

Could you please share some debugging steps to troubleshoot this issue ?

[JohnEGones]

I am not familiar with Splunk on Docker, so I don't have any experience that will be useful here. 

Some refs you may find useful: 

Architecture | docker-splunk
Navigation | docker-splunk
Forwarding data into indexer - Splunk Community (Similar question)

[JohnEGones]

I suppose I'll ask: did you verify network connectivity between the host (with I presume a UF) and the HFs? And the HFs and the Indexing peers? Makig sure there are no issues with switches or firewalls (opening needed ports etc.)

[NReddy12]

Yes @inventsekar , I'm able to verify the inputs.

/opt/splunkforwarder # ./bin/splunk btool inputs list --debug | grep tcp
/opt/splunkforwarder/etc/apps/SplunkUniversalForwarder/default/inputs.conf [splunktcp]
/opt/splunkforwarder/etc/system/default/inputs.conf                        [tcp]
/opt/splunkforwarder/etc/system/local/inputs.conf                          [tcp://10.196.246.1:7514]


/opt/splunkforwarder # ./bin/splunk btool outputs list --debug | grep tcp
/opt/splunkforwarder/etc/apps/SplunkUniversalForwarder/default/outputs.conf [tcpout]
/opt/splunkforwarder/etc/system/default/outputs.conf                        tcpSendBufSz = 0
/opt/splunkforwarder/etc/system/local/outputs.conf                          [tcpout:ib_group]

[inventsekar]

Hi @NReddy12 ...

using the btool, are you able to verify if the inputs is listed..

$SPLUNK_HOME$/bin/splunk btool inputs list --debug | grep tcp