I have a doubt here..I want to index data to both sandbox and production. What changes do I need to make here.
[tcpout]
defaultGroup = production
[tcpout:sandbox]
server=ABC:PORT
[tcpout...
...outeandfilterdatad. Or by directly setting the _TCP_ROUTING with inputs.conf on the UF. In outputs.conf we configure the two different destinations as in the example below. We see that in all Splunkdoc e...
...cpout:splunk]
server = indexer1:9997,indexer2:9997
I can see the client has successfully downloaded the outputs.conf file from the deployment server:
/opt/splunkforwarder/etc/apps/secure/outputs.conf...
Hi,
Can someone share with me the recent inputs & outputs conf file for SSL encryption? I am having some trouble for securing the connection between forwarder and indexer.
I have inherited a SPlunk environment and one thing i've noticed is that one all of our heavy forwarders are using useACK. Is this best practice? we are seeing duplicate events due to this, and...
Hi,
I have a new indexer that is ready to be used. My question is how do I get my hundreds of FWD's to pick it up? We have an app that controls the outputs.conf, but even if I update it, will t...
I've got my universal forwarders and heavy forwarders doing indexer discovery through the cluster master like so ... **************************
* outputs.conf...
...s set up as a Deployment Server as well) to pull the app that contains the testing SSL configuration for outputs.conf, certain devices do not hash the sslPassword when the UF restarts, while others d...
Hello, In a distributed environment with Universal Forwarder, Heavy Forwarder and Indexers, like this one: UF --> HF --> IDX How do you set useACK=true in outputs.conf ? Is it needed t...