Getting Data In

easy way to change _TCP_ROUTING = * ?????

wegscd
Contributor

I'm working on doing some data cloning.

As a first step, outputs.conf (on a virgin 6.4.1 universal forwarder on Windows) looks like this, and all is well.

[tcpout]
defaultGroup = default-autolb-group

[tcpout:default-autolb-group]
server = splunk-c-ix.local:9997

Data goes to splunk-c-ix just fine.

When I add another output group (even without making it the default or referring to it in any _TCP_ROUTING lines), then _internal output starts going to both groups.

[tcpout]
defaultGroup = default-autolb-group

[tcpout:default-autolb-group]
server = splunk-c-ix.local:9997

[tcpout:clone-group]
server = splunk-c-hf.local:9997

I dug into it, and found _TCP_ROUTING = * inside the [monitor://...] stanzas inside $SPLUNK_HOME\apps\SplunkUniversalForwarder\defaults\inputs.conf, which accounts for the behaviour.

I was hoping I could just do a blacklist for the _* indexes on the tcpout:clone-group, but the docs indicate that blacklist/whitelist only happens globally.

Is there an easy way to override this besides hunting down all the _TCP_ROUTING = * in the inputs.conf and overriding them in a local\inputs.conf?

gfuente
Motivator

Hello

Have you tried to include this, in your system/local/inputs.conf

[default]
_TCP_ROUTING = default-autolb-group

It should override all default settings, to send default inputs just to the default group.

Regards

0 Karma

wegscd
Contributor

will try this when I get a chance.

0 Karma

JuGuSm
Path Finder

Good answer but how to do this when you manage thousands of Universal Forwarder with the Deployment Server?

0 Karma

chris
Motivator

This seems to work for most inputs but the _internal inputs remain unchanged this is output from
/opt/splunkforwarder/bin/splunk btool inputs list

[monitor:///opt/splunkforwarder/var/log/splunk/metrics.log]
_TCP_ROUTING = *
_rcvbuf = 1572864
host = myVeryPersonalForwarder
index = _internal

Regards
Chris

0 Karma

wegscd
Contributor

make sense that this wouldn't work. The _TCP_ROUTING in a [default] stanza would only be used if _TCP_ROUTING was not specified elsewhere, and _TCP_ROUTING is specified elsewhere, so the [default] one gets ignored.

chris
Motivator

Were you able to solve this?

0 Karma

wegscd
Contributor

I hadn't receive gfuente's suggestion yet. which looks promising, I will have to see if it can be adapted to a deployment server fed environment (system/local/inputs.conf is not something that can be distributed via DS). That may be the way to go.

Right now, I just added overrides to the _TCP_ROUTING for guilty [monitor://] stanzas in a deployed inputs.conf:

[monitor://C:\Program Files\SplunkUniversalForwarder\etc\splunk.version]
_TCP_ROUTING = default-autolb-group

[monitor://C:\Program Files\SplunkUniversalForwarder\var\log\splunk\metrics.log]
_TCP_ROUTING = default-autolb-group

[monitor://C:\Program Files\SplunkUniversalForwarder\var\log\splunk\splunkd.log]
_TCP_ROUTING = default-autolb-group

It's ugly and a little brittle (will need to watch future versions to see if they add monitor: stanzas, and someone will break me sooner or later by deploying Splunk onto the 😧 drive), but it works.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...