Multiple Outputs - One Fails, Both Fail

[jharms70]

Hi there,

I have a HF which has two outputs - one to a set of Splunk indexers and one to a TCP-based syslog server.

The "stream" going to the index servers are the raw Windows logs, while the "stream" going to syslog is a clone of the original event which has been altered. We make use of the null queue to stop the cloned event being indexed by index servers as well.

We had a scenario where the syslog server was unavailable. This resulted in the queues filling up and logs not being forward to BOTH destinations.

I had a look through the outputs.conf doco and the following item looked like a likely fix if it were applied:

blockOnCloning (default is true).

Am I correct in assuming that with this set to false in outputs.conf, that the HF will still send data to the indexers in the event that the syslog server goes offline?

Thanks
Jono

[jharms70]

Found this https://answers.splunk.com/answers/626616/why-data-is-not-been-routing-to-second-group-when.html

Seems to answer my question. Any rep from Splunk to confirm would be ace though.