Yes, in inputs.conf on the indexer:
Instead of
[splunktcp://:9997]
Use one stanza for each host, like this
[splunktcp://host1.mycompany.com:9996]
[splunktcp://host2.mycompany.com:9996]
[splunktcp://host3.mycompany.com:9996]
Yes, in inputs.conf on the indexer:
Instead of
[splunktcp://:9997]
Use one stanza for each host, like this
[splunktcp://host1.mycompany.com:9996]
[splunktcp://host2.mycompany.com:9996]
[splunktcp://host3.mycompany.com:9996]
It worked! but first I had to disable the 9997 port from listening.
Thanks