Splunk Search

Having trouble with routing problem with _TCP_ROUTING?

okumar1
Engager

Hi,

I am having trouble for routing the logs(first.txt) to separate index1/2 and second.txt to index3/4.

 

below are my environment

inputs.conf

[monitor:///home/odelakumar06/first.txt]
disabled = false
host = hf
index = firstone
sourcetype = firstone
_TCP_ROUTING = FirstGroupIndexer

[monitor:///home/odelakumar06/second.txt]
disabled = false
host = hf
index = secondone
sourcetype = secondone
_TCP_ROUTING = SecondGroupIndexer

and my outputs.conf is

[tcpout]
defaultGroup = FirstGroupIndexer,SecondGroupIndexer

[tcpout:FirstGroupIndexer]
disabled = false
server = 34.100.154.111:9997,35.244.6.201:9997

[tcpout:SecondGroupIndexer]
disabled = false
server = 34.100.190.134:9997,34.93.239.18:9997

and i have one SH and i added all the above indexes in SH. 

when i search in SH index=firstone, nothing i am getting.

when i see splunkd log getting below errors. Please suggest

 

02-02-2023 06:33:10.051 +0000 ERROR TcpInputProc [1983 FwdDataReceiverThread] - Message rejected. Received unexpected message of size=1195725856 bytes from src=162.142.125.9:49748 in streaming mode. Maximum message size allowed=67108864. (::) Possible invalid source sending data to splunktcp port or valid source sending unsupported payload.
  • host = indx-1
  • source =/opt/splunk/var/log/splunk/splunkd.log
  • sourcetype = splunkd

 

Labels (1)
0 Karma

PaulPanther
Builder

@okumar1 Please provide some more information about your architecture. Are the 4 indexer part of one indexer cluster?

0 Karma

okumar1
Engager

no all 4 indexers are standalone only and i have added all these 4 search peers into SH under distributed search. Please guide me

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...