Hello, I have many forwarders sending logs to a cluster of indexers, and for some logs I need to send it not cooked. The problem is, when I add _TCP_ROUTING in my inputs.conf file, the logs are well sent to the correct server without being cooked, but they are not visible in Splunk (in the indexers). When I comment _TCP_ROUTING, the logs are correctly sent to the indexers. I noticed that when I re-comment the _TCP_ROUTING, the logs are not loose and appearing in Splunk after 1-2 minutes. inputs.conf
[monitor:///pqth/to/logs/*/*.log]
sourcetype = my:sourcetype
index = myindex
_TCP_ROUTING = logs_uncooked_to_send outputs.conf
[tcpout]
defaultGroup = default
[tcpout:default]
server = indexer1:9997,indexer2:9997,indexer3:9997,indexer4:9997
autoLBFrequency = 10
[tcpout:logs_uncooked_to_send]
server = server1:5066
sendCookedData= false Any idea what is blocking ? Maybe something I missed/don't mentioned here ?
... View more