Getting Data In

Why is the forwarder sending data to dev?

ddrillic
Ultra Champion

Our forwarder has the following -

$ cat /opt/splunk/splunkforwarder/etc/system/local/deploymentclient.conf
[target-broker:deploymentServer]
targetUri = prod deployment server:8089

However, it sends data to dev. How come?

Tags (1)
0 Karma
1 Solution

micahkemp
Champion

deploymentclient.conf doesn't configure outputs. But it does tell the forwarder where to get other configurations from, which likely means the deployment server it's pointed to is sending it an app with outputs.conf configured to send to dev. Or it could be that outputs.conf was manually configured on that forwarder to send to dev.

Run:

./bin/splunk btool outputs list --debug

To determine what your current outputs configuration looksl ike, and which files define that configuration.

View solution in original post

micahkemp
Champion

deploymentclient.conf doesn't configure outputs. But it does tell the forwarder where to get other configurations from, which likely means the deployment server it's pointed to is sending it an app with outputs.conf configured to send to dev. Or it could be that outputs.conf was manually configured on that forwarder to send to dev.

Run:

./bin/splunk btool outputs list --debug

To determine what your current outputs configuration looksl ike, and which files define that configuration.

ddrillic
Ultra Champion

Gorgeous @micahkemp

0 Karma

mayurr98
Super Champion

look at outputs.conf where you have configured data forwarding to maybe dev.
deploymentclient.conf would not help to troubleshoot that.
Also look at inputs.conf file on the forwarder.

ddrillic
Ultra Champion

Great - thank you!

0 Karma

skoelpin
SplunkTrust
SplunkTrust

The server that is sending data to dev, whats the output.conf file look like?

Another possibility is your routing data via transforms.conf

ddrillic
Ultra Champion

Perfect - output.conf it is ; -)

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...