Splunk Search

Multiple Outputs - One Fails, Both Fail

jharms70
New Member

Hi there,

I have a HF which has two outputs - one to a set of Splunk indexers and one to a TCP-based syslog server.

The "stream" going to the index servers are the raw Windows logs, while the "stream" going to syslog is a clone of the original event which has been altered. We make use of the null queue to stop the cloned event being indexed by index servers as well.

We had a scenario where the syslog server was unavailable. This resulted in the queues filling up and logs not being forward to BOTH destinations.

I had a look through the outputs.conf doco and the following item looked like a likely fix if it were applied:

blockOnCloning (default is true).

Am I correct in assuming that with this set to false in outputs.conf, that the HF will still send data to the indexers in the event that the syslog server goes offline?

Thanks
Jono

Tags (1)
0 Karma

jharms70
New Member

Found this https://answers.splunk.com/answers/626616/why-data-is-not-been-routing-to-second-group-when.html

Seems to answer my question. Any rep from Splunk to confirm would be ace though.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...