Getting Data In

Forwarding and receiving - Error occurred attempting to remove a tcpout input from Splunk Web

season88481
Contributor

Hi guys,

I configured my all-in-one Splunk instance to forward data to another search head by using an tcpout:9997 at outputs.conf. Then I removed the config file manually from Ubuntu command line.

However, I found data from my all-in-one Splunk box still forwarding to the other SH after reboot.

So I checked Forwarding and receiving setting from Splunk Web. I found the previous setting still there. Please see the attached screenshot for details.
alt text

Is there a way to remove those two forward data configurations from either Splunk Web or CMD?

Could any one please help?

Cheers,
Vincent

0 Karma
1 Solution

season88481
Contributor

Hi everyone,

I used btool find a configuration in one of my apps has a tcpout setup at outputs.conf.

So I removed the configuration and restart Splunk. Issue is now resolved. 🙂

View solution in original post

season88481
Contributor

Hi everyone,

I used btool find a configuration in one of my apps has a tcpout setup at outputs.conf.

So I removed the configuration and restart Splunk. Issue is now resolved. 🙂

robinsonk
Engager

What was done to fix this issue? Experiencing the same thing in our environment

0 Karma

season88481
Contributor

Hi robinsonk,

I assume your Splunk is in a Linux environment as well?

You can use btool to find all configurations at outputs.conf.

Something like ./splunk cmd btool outputs list --debug | grep tcpout

Find the configuration you don't want. And manually delete the configuration from outputs.conf...

0 Karma

robinsonk
Engager

no we are Windows environment.

season88481
Contributor

Hi Windows can use btool as well. It is basically the same. Just remove ./ at the beginner of the cmd.
Check here for more information:
http://docs.splunk.com/Documentation/Splunk/6.4.1/Troubleshooting/Usebtooltotroubleshootconfiguratio...

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...