Getting Data In

Splunk forwarding, need information about a stanza in inputs.conf

somesoni2
SplunkTrust
SplunkTrust

Hi,

I am trying to setup forwarding on my Splunk instance and need information about the following stanza in etc/system/local/inputs.conf.

[splunktcp://9997]
connection_host = none
  1. What does this stanza is really used for? (not very clear with documentation)
  2. If I am trying to setup index and forward, does this stanza play any role in that? Currently I don't have this stanza in my inputs.conf and its failing.

Appreciate your help here.

Tags (2)
0 Karma
1 Solution

lukejadamec
Super Champion

On occasion you may experience all of your forwarders dropping off-line.
The stanza you mentioned fixes the problem.

How it works, no one really knows.... Well, some folks do. Looks like a DNS issue.

http://answers.splunk.com/answers/49833/splunk-forwarder-connection-refused-from-splunk-indexer

http://answers.splunk.com/answers/43259/intermediate-forwarder-connections-timeout

View solution in original post

0 Karma

lukejadamec
Super Champion

On occasion you may experience all of your forwarders dropping off-line.
The stanza you mentioned fixes the problem.

How it works, no one really knows.... Well, some folks do. Looks like a DNS issue.

http://answers.splunk.com/answers/49833/splunk-forwarder-connection-refused-from-splunk-indexer

http://answers.splunk.com/answers/43259/intermediate-forwarder-connections-timeout

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...