Skip to content

Instantly share code, notes, and snippets.

@ryanfaircloth

ryanfaircloth/outputs.conf

Last active March 25, 2021 21:05
Show Gist options
  • Save ryanfaircloth/72c350347932b406937643160dd2398d to your computer and use it in GitHub Desktop.
Save ryanfaircloth/72c350347932b406937643160dd2398d to your computer and use it in GitHub Desktop.
Download ZIP
Splunk High Volume 2s2
Raw
outputs.conf
#This will get used for anything that for some reason skips transforms like hec event such data is cooked and should lb well enough
[tcpout]
defaultGroup = target-0
#only used by default
[target-0]
server= idx1, idx2, idx3, idx4
autoLBVolume=20MB
#Only used by randomizer
[target-1]
server= idx1, idx2, idx3, idx4
autoLBVolume=20MB
[target-2]
server= idx1, idx2, idx3, idx4
autoLBVolume=20MB
[target-3]
server= idx1, idx2, idx3, idx4
autoLBVolume=20MB
[target-4]
server= idx1, idx2, idx3, idx4
autoLBVolume=20MB
Raw
props.conf
[default]
TRANSFORMS-output-randomizer=transform-random-output
Raw
transforms.conf
[transform-random-output]
REGEX=.
DEST_KEY=_TCP_ROUTING
INGEST_EVAL = random=random() % 4
FORMAT=target-$random$
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment