Getting Data In

Will my outputs.conf edits work to send both compressed and uncompressed outputs from universal forwarder?

dahlberg
New Member

I have a Universal Forwarder (UF) that I'd like to send out both compressed and uncompressed data streams to a single indexer. Would this outputs.conf work:

[tcpout]
defaultGroup = index_cluster, index_cluster2

[tcpout:index_cluster]
autoLBFrequency=60
autoLB=true
useACK=true
compressed=true
server=indexer:9996

[tcpout:index_cluster2]
compressed=false
server=indexer:9997

Also, how would I specify which files/data streams should go out to targetGroup index_cluster and which ones should go out to index_cluster2?

Thanks,
Mike

0 Karma
1 Solution

jkat54
SplunkTrust
SplunkTrust

Yes, they will work this way.

This is saying by default, send to both.

If you want to specify a target specific to an input use _TCP_ROUTING=name of tcpout on you inputs.conf stanza(s)

For example

[monitor::/var/log/logfile]
...
_TCP_ROUTING=index_cluster2

View solution in original post

jkat54
SplunkTrust
SplunkTrust

Yes, they will work this way.

This is saying by default, send to both.

If you want to specify a target specific to an input use _TCP_ROUTING=name of tcpout on you inputs.conf stanza(s)

For example

[monitor::/var/log/logfile]
...
_TCP_ROUTING=index_cluster2

Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...