After we upgraded from 4.3.4 to 5.0.1, in out Splunk output streams we started receiving the following unwanted events:
ForwardInfo build=143156 version=5.0.1 os=Linux arch=x86_64 hostname=<serverName> guid=A5E34FA-C8AC-4A52-A59B-5660FDA25F94 fwdType=full ssl=false lastIndexer=None
We are sending the output streams to another application which packages them for delivery to a Splunk instance on another isolated network.
Here are some snippets from our outputs.conf
[tcpout]
indexAndForward = true
defaultGroup = nothing
[tcp:nothing]
disabled = false
server = <false server name>
dropEventsonQueueFull = 1
[tcp:server1]
server = appserver1:port, appserver2:port
autoLBFrequency = 88
sendCookedData = false
heartbeatFrequency = 0
[tcp:server2]
....
This allows outputs events by server and allows us to keep this data separated into different files for events coming from different servers.
We have tried some other permutations:
a. Removing the defaultGroup
This removed the ForwarderInfo messages, but added audit log messages, which were more frequent
b. Remove the defaultGroup and add whitelist and blacklist to the tcpout stanza
forwaderindex.0.whitelist = .*
forwaderindex.1.blacklist = _.*
forwaderindex.2.whitelist = _whatever
This removed the audit logs and ForwardInfo events, but now all log events went to each output file, which is not what we are looking for either.
Anyone have any idea on removing the ForwarderInfo without adding anything to the stream?
