Hi
I have installed the OVA from the vmware app, but after 3.1, the SDC indexes locally, and does not send the data back to my central splunk installation.
How can that happen ? I can see the hydra framework looks to be doing what it shall. But instead of the data ending up in splunk indexers, it ends up locally on the data collector.
I have searched, and theres is only one indexAndForward=false, so that is not the problem.
Any have any ideas ?
Thx
André
did you follow step 19 from the docs http://docs.splunk.com/Documentation/VMW/3.1/Install/Getacollectionnode ?
did you follow step 19 from the docs http://docs.splunk.com/Documentation/VMW/3.1/Install/Getacollectionnode ?
no problem 😉 converted to answer so feel free to mark this as answered - thx
Oh, thx..... i did before upgrade, but I think I messed up after my upgrade, and removed some files, including the outputs.conf .... bummer
Thx
André