- Splunk Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- Encountered the following error while trying to sa...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I am trying to "Add new" in Forwarding and Receiving / Forward data. I simply want to add my Load Balanced Indexers, but it will not save / rather get the above error message. I know I can probably just edit the outputs.conf manually, but I don't understand why this won't work.
Ideas?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi shandman,
Just trust the UI like it said Enter host:port to forward data to. Data will be auto load balanced to each host:port. So if you want to add multiple servers, just add one by one and you will get an outputs.conf like this:
[tcpout]
defaultGroup = default-autolb-group
[tcpout-server://servername:9997]
[tcpout:default-autolb-group]
disabled = false
server = servername:9997,servername1:9997
[tcpout-server://servername1:9997]
I added first servername:9997 saved and added servername1:9997 as second.
Hope that helps ...
cheers, MuS
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi shandman,
Just trust the UI like it said Enter host:port to forward data to. Data will be auto load balanced to each host:port. So if you want to add multiple servers, just add one by one and you will get an outputs.conf like this:
[tcpout]
defaultGroup = default-autolb-group
[tcpout-server://servername:9997]
[tcpout:default-autolb-group]
disabled = false
server = servername:9997,servername1:9997
[tcpout-server://servername1:9997]
I added first servername:9997 saved and added servername1:9997 as second.
Hope that helps ...
cheers, MuS
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Oh wow! Nice. The description in the documentation made it sound like you could enter them all in one go, separated by comma's. This makes sense. TY!!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Can anyone help with this?
Threat Hunting Unlocked: How to Uplevel Your Threat Hunting With the PEAK Framework ...
Splunk APM: New Product Features + Community Office Hours Recap!
Index This | Forward, I’m heavy; backward, I’m not. What am I?
