I have a HF forwarding specific sourcetypes to two different indexer clusters. However, it does not seem to be working even though I have followed routing and filter data approach. All data seems to be forwarding to all indexers. (seeing errors on the second set of indexers since the index does not exist, which is expected) I've also confirmed there isn't any conflicting inputs taking precedence in system/local.
https://docs.splunk.com/Documentation/Splunk/7.3.1/Forwarding/Routeandfilterdatad
Any suggestions?
***outputs***
[tcpout]
indexAndForward = 0
[tcpout]
defaultGroup = **fis_search_peers**,**profile_search_peers**
[tcpout:**fis_search_peers**]
server = idx1:9997, idx2:9997, idx3:9997, idx4:9997, idx5:9997, idx6:9997, idx7:9997, idx8:9997
autoLBFrequency=15
autoLB=true
useACK=true
forceTimebasedAutoLB = true
[tcpout:**profile_search_peers**]
server = f_idx1:9997, f_idx2:9997, f_idx3:9997
autoLBFrequency=15
autoLB=true
useACK=true
forceTimebasedAutoLB = true
***inputs***
[integrated_payables]
connection = prd_integrated_payables
disabled = 0
index = integrated_payables
index_time_mode = dbColumn
input_timestamp_column_number = 2
interval = 900
mode = rising
query = SELECT [Id] ,\
[Date] ,\
[Thread] ,\
[Level] ,\
Logger ,\
NestedContext ,\
[Message] ,\
[Exception] ,\
[HostName] ,\
[Thread_Context_ID]\
FROM "Logging"."dbo"."Log"\
WHERE Date > ?\
ORDER BY Date ASC
sourcetype = prd_int_pay_payspan_logging_db
tail_rising_column_number = 2
_TCP_ROUTING = **fis_search_peers**
[monitor:///ma/xpressng/logs/WAS85//MA_XpressNG_Prd_ma.log]
sourcetype = prd_mba_infinity_application
index = mba_infinity
_TCP_ROUTING = **profile_search_peers**
↧