Hi There. I have 2 matching forwarders pointed to an indexer. One compresses, one doesn't. Any ideas why?
Machine that works
cat /opt/splunk/etc/system/local/outputs.conf
[tcpout]
defaultGroup = my_indexers
indexAndForward = true
[tcpout:my_indexers]
compressed = true
server = splunklog:29000
[tcpout-server://splunklog:29000]
compressed = true
Machine that doesn't work
cat /opt/splunk/etc/system/local/outputs.conf
[tcpout]
defaultGroup = my_indexers
indexAndForward = true
[tcpout:my_indexers]
compressed = true
server = splunklog:29001
[tcpout-server://splunklog:29001]
compressed = true
Indexer (machine that receives)
cat /opt/splunk/etc/system/local/inputs.conf
[default]
host = splunk.***********.com
[splunktcp://29000]
compressed = true
enableS2SHeartbeat = true
[splunktcp://29001]
compressed = true
enableS2SHeartbeat = true
Log that proves it (10...101 is the machine that doesn't send compressed)
tail /opt/splunk/var/logs/splunk/splunkd.log
10-04-2010 19:55:16.756 ERROR TcpInputProc - Received unrecognized signature --splunk-cooked-mode-v2--! from hostname=10.***.****.101, ip=10.***.****.101, port=41119
10-04-2010 19:55:16.756 INFO TcpInputProc - Hostname=10.***.****.101 closed connection
10-04-2010 19:55:47.771 INFO TcpInputProc - Connection in cooked mode from 10.***.****.101
10-04-2010 19:56:18.756 ERROR PipelineDataInput - Mismatch in configuration between forwarder and indexer. Expecting compressed data, but forwarder configured to send without compression
10-04-2010 19:56:18.756 ERROR TcpInputProc - Received unrecognized signature --splunk-cooked-mode-v2--! from hostname=10.***.****.101, ip=10.***.****.101, port=41120
10-04-2010 19:56:18.756 INFO TcpInputProc - Hostname=10.***.****.101 closed connection
I am also seeing the same behavior. My compression settings are also set the same as yours. Were you able to find an answer?
I'm having the same problem. Did you manage to fix it?