Splunk Search

How are our forwarders working without an Outputs.conf file

Gregski11
Contributor

so recently I went to troubleshoot some servers that were not showing up in our queries and that's when I discovered that the ones that work that actually send their Even Log data to our Indexers they do not have an Outputs.conf file, how can that be? in the etc\system\local that is 

0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @Gregski11,

if a forwarders sends lohs to indexers it must have an outputs.conf file, maybe not in $SPLUNK_HOME\etc\system\local, but in another location.

It0s usuallt a best practice to put outputs.conf and deploymentclient.conf files not in the above folder but in a dedicated TA ()called e.g. TA_Forwarders) to manage using a Deployment Server, in this way you can easily change or add Indexers or Deployment Server.

You can find the outputs.conf file using btool command by CLI on the Forwarder (https://docs.splunk.com/Documentation/Splunk/8.2.6/Troubleshooting/Usebtooltotroubleshootconfigurati...).

in few words:

./splunk btool outputs list --debug

the output will be the list of all options in all outputs.conf files present in your Forwarder.

Ciao.

Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @Gregski11,

if a forwarders sends lohs to indexers it must have an outputs.conf file, maybe not in $SPLUNK_HOME\etc\system\local, but in another location.

It0s usuallt a best practice to put outputs.conf and deploymentclient.conf files not in the above folder but in a dedicated TA ()called e.g. TA_Forwarders) to manage using a Deployment Server, in this way you can easily change or add Indexers or Deployment Server.

You can find the outputs.conf file using btool command by CLI on the Forwarder (https://docs.splunk.com/Documentation/Splunk/8.2.6/Troubleshooting/Usebtooltotroubleshootconfigurati...).

in few words:

./splunk btool outputs list --debug

the output will be the list of all options in all outputs.conf files present in your Forwarder.

Ciao.

Giuseppe

Gregski11
Contributor

@gcusello wrote:

Hi @Gregski11,

if a forwarders sends lohs to indexers it must have an outputs.conf file, maybe not in $SPLUNK_HOME\etc\system\local, but in another location.

It0s usuallt a best practice to put outputs.conf and deploymentclient.conf files not in the above folder but in a dedicated TA ()called e.g. TA_Forwarders) to manage using a Deployment Server, in this way you can easily change or add Indexers or Deployment Server.

You can find the outputs.conf file using btool command by CLI on the Forwarder (https://docs.splunk.com/Documentation/Splunk/8.2.6/Troubleshooting/Usebtooltotroubleshootconfigurati...).

in few words:

 

 

./splunk btool outputs list --debug

 

 

the output will be the list of all options in all outputs.conf files present in your Forwarder.

Ciao.

Giuseppe


ah, thank you sooooo much looks like they are in the etc\apps folder and subfolders named after our apps, really wish Splunk documentation said this, I followed like 19 of their docs and no mention of this from the forwarder and receiver perspective

Tags (1)
0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...