Deployment Architecture

Setting outputs.conf

rangineniarunku
Explorer

I have a doubt here..I want to index data to both sandbox and production. What changes do I need to make here.

[tcpout]
defaultGroup = production

[tcpout:sandbox]
server=ABC:PORT

[tcpout:production]
server=XYZ:PORT
autoLB = true
useACK = false

Tags (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi rangineniarunkumar,
just a little additional information:

  • are sandbox and production indexers?
  • do you want to send some logs to sandbox and some logs to production?

If this is your need, you should see at http://docs.splunk.com/Documentation/Splunk/6.5.2/Forwarding/Routeandfilterdatad where it's described how to configure your outputs.conf and inputs.conf files.

At first sight I see [default group] stanza in your outputs.conf and you should remove it.
In addition you have to insert in all your inputs.conf files stanzas _TCP_ROUTING = sandbox or _TCP_ROUTING = production depending by your logs.
If you want to send the same log to both the indexers you don't need to insert _TCP_ROUTING =

Bye.
Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi rangineniarunkumar,
just a little additional information:

  • are sandbox and production indexers?
  • do you want to send some logs to sandbox and some logs to production?

If this is your need, you should see at http://docs.splunk.com/Documentation/Splunk/6.5.2/Forwarding/Routeandfilterdatad where it's described how to configure your outputs.conf and inputs.conf files.

At first sight I see [default group] stanza in your outputs.conf and you should remove it.
In addition you have to insert in all your inputs.conf files stanzas _TCP_ROUTING = sandbox or _TCP_ROUTING = production depending by your logs.
If you want to send the same log to both the indexers you don't need to insert _TCP_ROUTING =

Bye.
Giuseppe

Get Updates on the Splunk Community!

Observability Unlocked: Kubernetes & Cloud Monitoring with Splunk IM

Ready to master Kubernetes and cloud monitoring like the pros? Join Splunk’s Growth Engineering team on ...

Index This | What did the zero say to the eight?

June 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

Splunk Observability Cloud's AI Assistant in Action Series: Onboarding New Hires & ...

This is the fifth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...