Splunk Search

How to set a backup TCPOUT group in Outputsconf

morethanyell
Contributor

Hi,

From my understanding, the param `defaultGroup` under the stanza `[tcpout]` in `outputs.conf` can be set to a comma-separated list based on what's defined in `[tcpout:<groupn>]` stanzas, i.e.:

[tcpout]
defaultGroup = group1, group2, group3, group4

[tcpout:group1] server=10.1.1.197:9997
[tcpout:group2] server=myhost.Splunk.com:9997
[tcpout:group3] server=myhost.Splunk.com:9997,10.1.1.197:6666
[tcpout:group4] server=foo.Splunk.com:9997

Okay. But when we define `outputs.conf` like this, the forwarder will route all traffic to the target servers in all groups defined in that param `defaultGroup`.

How do we define a "backup" group where in the traffic is rerouted to the "next" group in case the default groups aren't reachable?

Labels (1)
0 Karma
1 Solution

soutamo
SplunkTrust
SplunkTrust
At least I haven’t hear or read this kind of feature. Probably you should write this to ideas.splunk.com.

r. Ismo

View solution in original post

morethanyell
Contributor

Those aren't indexers. They are intermediate heavyforwarders that represent regions. I.e.

# North America UF Outputsconf

[tcpout]
defaultGroup = NA

[tcpout:EMEA] server = mycompany-emea-hfa:9997, mycompany-emea-hfb:9997
[tcpout:APAC] server = mycompany-apac-hfa:9997, mycompany-apac-hfb:9997
[tcpout:NA] server = mycompany-na-hfa:9997, mycompany-na-hfb:9997
[tcpout:LATAM] server = mycompany-latam-hfa:9997, mycompany-latam-hfb:9997

 These intermediate HFs all output to SplunkCloud. I was thinking how I could route traffic to LATAM if say, the servers in NA are down.

0 Karma

soutamo
SplunkTrust
SplunkTrust
At least I haven’t hear or read this kind of feature. Probably you should write this to ideas.splunk.com.

r. Ismo

View solution in original post

morethanyell
Contributor

Thank you. Just did.

EID-I-644

0 Karma

soutamo
SplunkTrust
SplunkTrust

Hi

Actually there is one way to do this, but it requires that you are using multisite cluster with indexes discovery feature enabled. Then you can just add on your CM: 

splunk edit cluster-config -forwarder_site_failover site1:site2

r. Ismo

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Rather that use multiple groups of one indexer each, use a single group of multiple indexers.  The UF will send to each indexer in turn, skipping those that are not available.

[tcpout]
defaultGroup = group1

[tcpout:group1]
server=10.1.1.197:9997,myhost.Splunk.com:9997,foo.Splunk.com:9997

If your indexers are clustered then consider using Indexer Discovery, which achieves the same effect.

---
If this reply helps you, an upvote would be appreciated.
0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!