Getting Data In

Where do I put the outputs.conf file to disable indexing on my search head?

fisuser1
Contributor

Where do I put the outputs.conf file to disable indexing on my search head? Does this go in /splunk/etc/system/local or in one of the apps on the SH?

[tcpout]
defaultGroup = primary_indexer

[tcpout:primary_indexer]
server = ##.##.###.##:9997

0 Karma
1 Solution

mrgibbon
Contributor

Personally I would create a deployment app and push it out where needed.
But if you are only running one machine, you can put it in either place you mention, just be aware in /system/local/ it will overrule anything in the /apps/myapp/local folders.

Cheers

View solution in original post

mrgibbon
Contributor

Personally I would create a deployment app and push it out where needed.
But if you are only running one machine, you can put it in either place you mention, just be aware in /system/local/ it will overrule anything in the /apps/myapp/local folders.

Cheers

fisuser1
Contributor

Forgot to include this in my original.

[indexAndForward]
index = false

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...