I have Http Event Collector inputs defined on an indexer cluster. I need to send one of the tokens' data to a different indexer.
_TCP_ROUTING in inputs, plus an outputs.conf def?
If so, what magic in outputs.conf do I need to ensure most traffic ignores the special case and just indexes normally?
Yes, your proposed method will work. I've done it before just fine.
Everything else will use the default routing group
Here's an example using plain TCP:
That didn't work. I added this stanza (alone) to the CM and applied. No other changes. I had assumed that default would remain undefined and therefore it would index locally.
[tcpout:dc1_indexers] server = dc1_indexers:9997 autoLBFrequency = 20 autoLBVolume = 10000 compressed = true useACK = false
All locally indexed data disappeared, and tons of logs regarding TcpOutputProc connections to the indexers in the dc1_indexers cluster above.
So how do you add an output destination that will not take over default when you want to maintain local indexing?