I experience this issue too.
My current setup is:
1 Centos: NGINX Loadbalancer + Splunk Universal forwarder 6.5
Configurations locations $SPLUNK_HOME/etc/apps//local/
inputs.conf
[monitor:///var/log/nginx/acc*]
disabled = false
index = internal_loadbalancer
sourcetype = nginx:plus:access
whitelist = access.log(-|\.)\d*
ignoreOlderThan = 30h
[monitor:///var/log/nginx/e*]
disabled = false
index = internal_loadbalancer
sourcetype = nginx:plus:error
whitelist = error.log(-|\.)\d*
ignoreOlderThan = 30h
output.conf
[tcpout]
defaultGroup=indx
[tcpout:indx]
disabled=false
server=<indexIP>:9997
compressed=true
sendCookedData=ttue
autoLB=true
1 Centos: Splunk Enterprise 6.5
netstat -an | grep 9997
tcp 0 0 0.0.0.0:9997 0.0.0.0:* LISTEN
tcp 0 0 10.0.10.6:9997 10.0.10.5:56079 ESTABLISHED
... View more
