I followed your suggestion. The output is as follows: [root@uf1 splunkforwarder]# bin/splunk list forward-server
Active forwards:
3rd_party_node_1:3535
3rd_party_node_2:3535
so1:9997
Configured but inactive forwards:
None
[root@uf1 splunkforwarder]# And the tail: [root@uf1 splunkforwarder]# tail -f /opt/splunkforwarder/var/log/splunk/splunkd.log | grep "TcpOutputProc"
10-30-2020 20:27:34.719 +0000 INFO TcpOutputProc - Connected to idx=172.19.0.3:3535, pset=0, reuse=0.
10-30-2020 20:27:39.613 +0000 INFO TcpOutputProc - After randomization, current is first in the list. Swapping with last item
10-30-2020 20:27:39.713 +0000 INFO TcpOutputProc - Connected to idx=172.19.0.2:3535, pset=0, reuse=1.
10-30-2020 20:27:43.720 +0000 INFO TcpOutputProc - Connected to idx=172.19.0.3:3535, pset=0, reuse=0.
10-30-2020 20:27:48.724 +0000 INFO TcpOutputProc - Connected to idx=172.19.0.2:3535, pset=0, reuse=1.
10-30-2020 20:27:52.722 +0000 INFO TcpOutputProc - Connected to idx=172.19.0.3:3535, pset=0, reuse=0.
10-30-2020 20:27:57.723 +0000 INFO TcpOutputProc - Connected to idx=172.19.0.2:3535, pset=0, reuse=1.
10-30-2020 20:27:59.335 +0000 INFO TcpOutputProc - Found currently active indexer. Connected to idx=172.19.0.4:9997, reuse=1.
10-30-2020 20:28:01.691 +0000 INFO TcpOutputProc - Connected to idx=172.19.0.3:3535, pset=0, reuse=0.
10-30-2020 20:28:06.719 +0000 INFO TcpOutputProc - Connected to idx=172.19.0.2:3535, pset=0, reuse=1.
10-30-2020 20:28:10.690 +0000 INFO TcpOutputProc - Connected to idx=172.19.0.3:3535, pset=0, reuse=0.
10-30-2020 20:28:15.694 +0000 INFO TcpOutputProc - Connected to idx=172.19.0.2:3535, pset=0, reuse=1.
10-30-2020 20:28:19.691 +0000 INFO TcpOutputProc - Connected to idx=172.19.0.3:3535, pset=0, reuse=0.
10-30-2020 20:28:24.695 +0000 INFO TcpOutputProc - Connected to idx=172.19.0.2:3535, pset=0, reuse=1.
10-30-2020 20:28:28.691 +0000 INFO TcpOutputProc - Connected to idx=172.19.0.3:3535, pset=0, reuse=0.
10-30-2020 20:28:29.193 +0000 INFO TcpOutputProc - Found currently active indexer. Connected to idx=172.19.0.4:9997, reuse=1.
10-30-2020 20:28:33.560 +0000 INFO TcpOutputProc - After randomization, current is first in the list. Swapping with last item
10-30-2020 20:28:33.661 +0000 INFO TcpOutputProc - Connected to idx=172.19.0.2:3535, pset=0, reuse=1.
10-30-2020 20:28:37.658 +0000 INFO TcpOutputProc - Connected to idx=172.19.0.3:3535, pset=0, reuse=0.
10-30-2020 20:28:42.561 +0000 INFO TcpOutputProc - After randomization, current is first in the list. Swapping with last item
10-30-2020 20:28:42.661 +0000 INFO TcpOutputProc - Connected to idx=172.19.0.2:3535, pset=0, reuse=1.
10-30-2020 20:28:46.659 +0000 INFO TcpOutputProc - Connected to idx=172.19.0.3:3535, pset=0, reuse=0.
10-30-2020 20:28:51.664 +0000 INFO TcpOutputProc - Connected to idx=172.19.0.2:3535, pset=0, reuse=1.
10-30-2020 20:28:55.661 +0000 INFO TcpOutputProc - Connected to idx=172.19.0.3:3535, pset=0, reuse=0.
10-30-2020 20:28:59.061 +0000 INFO TcpOutputProc - Found currently active indexer. Connected to idx=172.19.0.4:9997, reuse=1.
10-30-2020 20:29:00.662 +0000 INFO TcpOutputProc - Connected to idx=172.19.0.2:3535, pset=0, reuse=1.
10-30-2020 20:29:04.626 +0000 INFO TcpOutputProc - Connected to idx=172.19.0.3:3535, pset=0, reuse=0.
10-30-2020 20:29:09.530 +0000 INFO TcpOutputProc - After randomization, current is first in the list. Swapping with last item
10-30-2020 20:29:09.630 +0000 INFO TcpOutputProc - Connected to idx=172.19.0.2:3535, pset=0, reuse=1.
^C
[root@uf1 splunkforwarder]# So, I can see that both servers are taken into account but it always skips one and only uses the same other. That is also what I see on both nodes; only 1 out of two in getting the tcp inputs. So I got rid of the cloning, but this is also not what I want. Is this what you expect?
... View more