Getting Data In

Route event data to different target groups issue

belasker
New Member

Hi Splunkers,
here are my 3 configuration files transforms,props,outputs

/// props.conf
[host:firstClient]
TRANSFORMS-routing=apacheWindows

[host:secondClient]
TRANSFORMS-routing=apacheLinux

/// transforms.conf
[apacheWindows]
REGEX= .
DEST_KEY=_TCP_ROUTING
FORMAT=apacheWindows

[apacheLinux]
REGEX= .
DEST_KEY=_TCP_ROUTING
FORMAT=apacheLinux

// outputs.conf
[tcpout]
defaultGroup = default-group

[tcpout:apacheWindows]
server=192.168.1.25:9997

[tcpout:apacheLinux]
server=192.168.1.24:9997

[tcpout:default-group]
server=192.168.1.25:9997

the issue here is when i use default-group all the data will be forwarded to the default-group address even tcpout:apacheLinux
and when i remove default-group from outputs.conf ,data is forwaded correctly to the 2 different indexers

here the example that i have followed in splunk official documentation

/////

[tcpout]
defaultGroup=everythingElseGroup

[tcpout:syslogGroup]
server=10.1.1.197:9996, 10.1.1.198:9997

[tcpout:errorGroup]
server=10.1.1.200:9999

[tcpout:everythingElseGroup]
server=10.1.1.250:6666
syslogGroup and errorGroup receive events according to the rules specified in transforms.conf. All other events get routed to the default group, everythingElseGroup.

//////

Thank you.

Tags (1)
0 Karma
1 Solution

MuS
SplunkTrust
SplunkTrust

Hi belasker,

If you read the docs for outputs.conf http://docs.splunk.com/Documentation/Splunk/latest/Admin/Outputsconf you will find this:

defaultGroup = <target_group>, <target_group>, ...
* The forwarder sends all data to the specified groups.
* If you don't want to forward data automatically, don't set this attribute.

That said, as soon as you use the defaultGroup in your outputs.conf Splunk will send all events to the defined group.

Hope that helps to understand the setting ...

cheers, MuS

View solution in original post

0 Karma

MuS
SplunkTrust
SplunkTrust

Hi belasker,

If you read the docs for outputs.conf http://docs.splunk.com/Documentation/Splunk/latest/Admin/Outputsconf you will find this:

defaultGroup = <target_group>, <target_group>, ...
* The forwarder sends all data to the specified groups.
* If you don't want to forward data automatically, don't set this attribute.

That said, as soon as you use the defaultGroup in your outputs.conf Splunk will send all events to the defined group.

Hope that helps to understand the setting ...

cheers, MuS

0 Karma

belasker
New Member

Thank you but In splunk official documentation (last example) they said " All other events get routed to the default group, everythingElseGroup" that means syslogGroup and errorGroup will be forwarded to the right place not the defaultgroup.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...