Splunk_Docker/files/splunkbeta/etc/modules/distributedDeployment/classes/deployable

This bundle enables metrics information to be routed from all DeploymentClient(s) (i.e. 'deployable' Splunks) to the DeploymentServer.



outputs.conf

------------

This configuration will establish a tcpout route by the name of 'RouteMetricsToDeploymentServer'. Make sure you change the server_name:port information. Any event with a _TCP_ROUTING field will be forwarder to the specified server. Our intention is to add this field to all events in metrics.log - see inputs.conf below.



[tcpout:RouteMetricsToDeploymentServer]

server=YourDeploymentServerHostname:9997





inputs.conf

-----------

The following configuration will cause all metrics.log events to be routed to a tcpout group named 'RouteMetricsToDeploymentServer'. See outputs.conf above on how that happens.



[monitor://$SPLUNK_HOME/var/log/splunk/metrics.log]

_TCP_ROUTING = RouteMetricsToDeploymentServer