Getting Data In

outputs.conf defaultGroup wildcard not working

mw
Splunk Employee
Splunk Employee

Based on the docs ( http://www.splunk.com/base/Documentation/4.2.1/Deploy/Configureforwarderswithoutputs.confd#Define_ty... ), I've created this outputs.conf:

me@server:/opt/splunkforwarder> cat etc/apps/dc_global_uf/default/outputs.conf
[tcpout]
defaultGroup = *
indexAndForward = false

[tcpout:group1]
compressed = false
server = work:9997
useACK = true

However, that seems to not work and gives this error:

05-06-2011 23:06:11.174 -0400 ERROR TcpOutputProc - the 'defaultGroup' property contains an invalid group name - * - skipping

Did I read/do something incorrectly, or should the wildcard work?

Tags (1)
0 Karma
1 Solution

gkanapathy
Splunk Employee
Splunk Employee

defaultGroup can not be a wildcard. It must refer to a specfic group or list of groups, in your example,

defaultGroup = group1

From http://www.splunk.com/base/Documentation/latest/Admin/Outputsconf :

defaultGroup = <target_group>, <target_group>, ...
* Comma-separated list of one or more target group names, specified later in [tcpout:<target_group>] stanzas.
* The forwarder sends all data to the specified groups.
* Can be set to a name that matches no groups to disable automatic forwarding. For example, "defaultGroup=do_not_forward".
* Can be overridden by an inputs.conf _TCP_ROUTING setting, which in turn can be overridden by a 
  props.conf/transforms.conf modifier.
* This attribute is required. The behavior of forwarding without this value is inconsistent across some versions.

View solution in original post

gkanapathy
Splunk Employee
Splunk Employee

defaultGroup can not be a wildcard. It must refer to a specfic group or list of groups, in your example,

defaultGroup = group1

From http://www.splunk.com/base/Documentation/latest/Admin/Outputsconf :

defaultGroup = <target_group>, <target_group>, ...
* Comma-separated list of one or more target group names, specified later in [tcpout:<target_group>] stanzas.
* The forwarder sends all data to the specified groups.
* Can be set to a name that matches no groups to disable automatic forwarding. For example, "defaultGroup=do_not_forward".
* Can be overridden by an inputs.conf _TCP_ROUTING setting, which in turn can be overridden by a 
  props.conf/transforms.conf modifier.
* This attribute is required. The behavior of forwarding without this value is inconsistent across some versions.

mw
Splunk Employee
Splunk Employee

Awesome, thanks!

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

The other docs you reference were wrong, and have been corrected

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...