Do you have any events being indexed? ... View more

Hi rgill90, only saw your message today. I have one example as follows: Inputs.conf [splunktcp://:9997] connection_host = ip _TCP_ROUTING = splunkssl Outputs.conf [tcpout] defaultGroup = splunkssl [tcpout:splunkssl] compressed = true server = :9997 sslCertPath = ... sslPassword = ... sslRootCAPath = ... sslVerifyServerCert = true As you can see, the attribute value at inputs.conf of _TCP_ROUTING is splunkssl and at the outputs you must have that same name at tcpout. Naturally you can give any name you want (no need to be "splunkssl" but they must match in both files) ... View more