Splunk Search

How are our forwarders working without an Outputs.conf file

Gregski11
Contributor

so recently I went to troubleshoot some servers that were not showing up in our queries and that's when I discovered that the ones that work that actually send their Even Log data to our Indexers they do not have an Outputs.conf file, how can that be? in the etc\system\local that is 

Labels (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @Gregski11,

if a forwarders sends lohs to indexers it must have an outputs.conf file, maybe not in $SPLUNK_HOME\etc\system\local, but in another location.

It0s usuallt a best practice to put outputs.conf and deploymentclient.conf files not in the above folder but in a dedicated TA ()called e.g. TA_Forwarders) to manage using a Deployment Server, in this way you can easily change or add Indexers or Deployment Server.

You can find the outputs.conf file using btool command by CLI on the Forwarder (https://docs.splunk.com/Documentation/Splunk/8.2.6/Troubleshooting/Usebtooltotroubleshootconfigurati...).

in few words:

./splunk btool outputs list --debug

the output will be the list of all options in all outputs.conf files present in your Forwarder.

Ciao.

Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @Gregski11,

if a forwarders sends lohs to indexers it must have an outputs.conf file, maybe not in $SPLUNK_HOME\etc\system\local, but in another location.

It0s usuallt a best practice to put outputs.conf and deploymentclient.conf files not in the above folder but in a dedicated TA ()called e.g. TA_Forwarders) to manage using a Deployment Server, in this way you can easily change or add Indexers or Deployment Server.

You can find the outputs.conf file using btool command by CLI on the Forwarder (https://docs.splunk.com/Documentation/Splunk/8.2.6/Troubleshooting/Usebtooltotroubleshootconfigurati...).

in few words:

./splunk btool outputs list --debug

the output will be the list of all options in all outputs.conf files present in your Forwarder.

Ciao.

Giuseppe

Gregski11
Contributor

@gcusello wrote:

Hi @Gregski11,

if a forwarders sends lohs to indexers it must have an outputs.conf file, maybe not in $SPLUNK_HOME\etc\system\local, but in another location.

It0s usuallt a best practice to put outputs.conf and deploymentclient.conf files not in the above folder but in a dedicated TA ()called e.g. TA_Forwarders) to manage using a Deployment Server, in this way you can easily change or add Indexers or Deployment Server.

You can find the outputs.conf file using btool command by CLI on the Forwarder (https://docs.splunk.com/Documentation/Splunk/8.2.6/Troubleshooting/Usebtooltotroubleshootconfigurati...).

in few words:

 

 

./splunk btool outputs list --debug

 

 

the output will be the list of all options in all outputs.conf files present in your Forwarder.

Ciao.

Giuseppe


ah, thank you sooooo much looks like they are in the etc\apps folder and subfolders named after our apps, really wish Splunk documentation said this, I followed like 19 of their docs and no mention of this from the forwarder and receiver perspective

Tags (1)
0 Karma
Get Updates on the Splunk Community!

Cloud Platform & Enterprise: Classic Dashboard Export Feature Deprecation

As of Splunk Cloud Platform 9.3.2408 and Splunk Enterprise 9.4, classic dashboard export features are now ...

Explore the Latest Educational Offerings from Splunk (November Releases)

At Splunk Education, we are committed to providing a robust learning experience for all users, regardless of ...

New This Month in Splunk Observability Cloud - Metrics Usage Analytics, Enhanced K8s ...

The latest enhancements across the Splunk Observability portfolio deliver greater flexibility, better data and ...