How are our forwarders working without an Outputs.conf file

[Gregski11]

so recently I went to troubleshoot some servers that were not showing up in our queries and that's when I discovered that the ones that work that actually send their Even Log data to our Indexers they do not have an Outputs.conf file, how can that be? in the etc\system\local that is 

[gcusello · Accepted solution]

Hi @Gregski11,

if a forwarders sends lohs to indexers it must have an outputs.conf file, maybe not in $SPLUNK_HOME\etc\system\local, but in another location.

It0s usuallt a best practice to put outputs.conf and deploymentclient.conf files not in the above folder but in a dedicated TA ()called e.g. TA_Forwarders) to manage using a Deployment Server, in this way you can easily change or add Indexers or Deployment Server.

You can find the outputs.conf file using btool command by CLI on the Forwarder (https://docs.splunk.com/Documentation/Splunk/8.2.6/Troubleshooting/Usebtooltotroubleshootconfigurati...).

in few words:

./splunk btool outputs list --debug

the output will be the list of all options in all outputs.conf files present in your Forwarder.

Ciao.

Giuseppe

[Gregski11]

---

@gcusello wrote:

Hi @Gregski11,

if a forwarders sends lohs to indexers it must have an outputs.conf file, maybe not in $SPLUNK_HOME\etc\system\local, but in another location.

It0s usuallt a best practice to put outputs.conf and deploymentclient.conf files not in the above folder but in a dedicated TA ()called e.g. TA_Forwarders) to manage using a Deployment Server, in this way you can easily change or add Indexers or Deployment Server.

You can find the outputs.conf file using btool command by CLI on the Forwarder (https://docs.splunk.com/Documentation/Splunk/8.2.6/Troubleshooting/Usebtooltotroubleshootconfigurati...).

in few words:

./splunk btool outputs list --debug

the output will be the list of all options in all outputs.conf files present in your Forwarder.

Ciao.

Giuseppe

---

ah, thank you sooooo much looks like they are in the etc\apps folder and subfolders named after our apps, really wish Splunk documentation said this, I followed like 19 of their docs and no mention of this from the forwarder and receiver perspective