- Splunk Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- Why is the forwarder sending data to dev?
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Our forwarder has the following -
$ cat /opt/splunk/splunkforwarder/etc/system/local/deploymentclient.conf
[target-broker:deploymentServer]
targetUri = prod deployment server:8089
However, it sends data to dev. How come?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
deploymentclient.conf doesn't configure outputs. But it does tell the forwarder where to get other configurations from, which likely means the deployment server it's pointed to is sending it an app with outputs.conf configured to send to dev. Or it could be that outputs.conf was manually configured on that forwarder to send to dev.
Run:
./bin/splunk btool outputs list --debug
To determine what your current outputs configuration looksl ike, and which files define that configuration.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
deploymentclient.conf doesn't configure outputs. But it does tell the forwarder where to get other configurations from, which likely means the deployment server it's pointed to is sending it an app with outputs.conf configured to send to dev. Or it could be that outputs.conf was manually configured on that forwarder to send to dev.
Run:
./bin/splunk btool outputs list --debug
To determine what your current outputs configuration looksl ike, and which files define that configuration.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Gorgeous @micahkemp
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
look at outputs.conf where you have configured data forwarding to maybe dev.
deploymentclient.conf would not help to troubleshoot that.
Also look at inputs.conf file on the forwarder.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Great - thank you!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The server that is sending data to dev, whats the output.conf file look like?
Another possibility is your routing data via transforms.conf
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Perfect - output.conf it is ; -)
Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!
They're back! Join the SplunkTrust and MVP at .conf24
Enterprise Security Content Update (ESCU) | New Releases
