Where do I put the outputs.conf file to disable indexing on my search head? Does this go in /splunk/etc/system/local or in one of the apps on the SH?
[tcpout]
defaultGroup = primary_indexer
[tcpout:primary_indexer]
server = ##.##.###.##:9997
Personally I would create a deployment app and push it out where needed.
But if you are only running one machine, you can put it in either place you mention, just be aware in /system/local/ it will overrule anything in the /apps/myapp/local folders.
Cheers
Personally I would create a deployment app and push it out where needed.
But if you are only running one machine, you can put it in either place you mention, just be aware in /system/local/ it will overrule anything in the /apps/myapp/local folders.
Cheers
Forgot to include this in my original.
[indexAndForward]
index = false