Which optional configuration setting in inputs.conf allows you to selectively forward the data to specific indexer(s)?
Which optional configuration setting in inputs.conf allows you to selectively forward the data to specific indexer(s)?
The optional configuration setting in inputs.conf that allows you to selectively forward the data to specific indexer(s) is _TCP_ROUTING. This setting specifies a comma-separated list of tcpout group names, which you define in the outputs.conf file. By using this setting, you can control which indexers receive the data, enabling selective data forwarding.
A. _TCP_ROUTING
A P66 on Data Admin pdf
A is correct
[monitor:<file path>] _TCP_ROUTING = <index name> In inputs.conf (UF)
A. Extra read: https://docs.splunk.com/Documentation/Splunk/7.0.3/Forwarding/Routeandfilterdatad#Perform_selective_indexing_and_forwarding
Per the provided reference URL _TCP_ROUTING = <tcpout_group_name>,<tcpout_group_name>,... Specifies a comma-separated list of tcpout group names. Use this setting to selectively forward your data to specific indexers by specifying the tcpout groups that the forwarder should use when forwarding the data. Define the tcpout group names in the outputs.conf file in [tcpout:<tcpout_group_name>] stanzas. The groups present in defaultGroup in [tcpout] stanza in the outputs.conf file.