We followed current documentation: [tcpout]
defaultGroup = <comma-separated list>
* A comma-separated list of one or more target group names, specified later
in [tcpout:<target_group>] stanzas.
* The forwarder sends all data to the specified groups.
* If you don't want to forward data automatically, don't configure this setting.
* Can be overridden by the '_TCP_ROUTING' setting in the inputs.conf file,
which in turn can be overridden by a props.conf or transforms.conf modifier.
* Starting with version 4.2, this setting is no longer required. Data forwarding is working, but the state of the cluster is invalid. We also noted these crash logs and we think they are related to this problem: Received fatal signal 6 (Aborted) on PID 2521742.
Cause:
Signal sent by PID 2521742 running under UID 1001.
Crashing thread: TcpOutEloop
...........
Backtrace (PIC build):
[0x00007F02A9F91A7C] pthread_kill + 300 (libc.so.6 + 0x6EA7C)
[0x00007F02A9F3D476] raise + 22 (libc.so.6 + 0x1A476)
[0x00007F02A9F237F3] abort + 211 (libc.so.6 + 0x7F3)
[0x0000556B5A5B0FA9] ? (splunkd + 0x1A52FA9)
[0x0000556B5BA12B6E] _ZN11TimeoutHeap18runExpiredTimeoutsER13MonotonicTime + 670 (splunkd + 0x2EB4B6E)
[0x0000556B5B939260] _ZN9EventLoop18runExpiredTimeoutsER13MonotonicTime + 32 (splunkd + 0x2DDB260)
[0x0000556B5B93A690] _ZN9EventLoop3runEv + 208 (splunkd + 0x2DDC690)
[0x0000556B5A97185E] _ZN11Distributed11EloopRunner4mainEv + 206 (splunkd + 0x1E1385E)
[0x0000556B5BA0957D] _ZN6Thread37_callMainAndDiscardTerminateExceptionEv + 13 (splunkd + 0x2EAB57D)
[0x0000556B5BA0A413] _ZN6Thread8callMainEPv + 147 (splunkd + 0x2EAC413)
[0x00007F02A9F8FB43] ? (libc.so.6 + 0x6CB43)
[0x00007F02AA021A00] ? (libc.so.6 + 0xFEA00)
Linux / splunk-indexer01 / 5.15.0-76-generic / #83-Ubuntu SMP Thu Jun 15 19:16:32 UTC 2023 / x86_64
assertion_failure="!_current_timeout_was_readded" assertion_function="void TimeoutHeap::assert_didnt_get_readded() const" assertion_file="/builds/splcore/main/src/util/TimeoutHeap.h:527"
/etc/debian_version: bookworm/sid
Last errno: 0
Threads running: 85
Runtime: 61.996351s
argv: [splunkd --under-systemd --systemd-delegate=yes -p 8089 _internal_launch_under_systemd]
Regex JIT enabled
.......
... View more