通用转发器未将数据转发到Splunk索引器
适用范围
通用转发器描述
由于$SPLUNK_HOME/etc/system/local/outputs.conf配置错误，Splunk Universal Forwarder未按预期转发数据调查
通用转发器上的$SPLUNK_HOME/var/log/splunk/splunkd.log中将显示以下错误消息：'09-06-2019 10:53:39.389 -0400 ERROR TcpOutputProc - LightWeightForwarder/UniversalForwarder not configured. Please configure outputs.conf.'
分辨率
此错误消息可以通过在$SPLUNK_HOME/etc/system/local/outputs.conf文件中配置以下设置解决：[tcpout]defaultGroup = <target_group>, <target_group>, ... * A comma-separated list of one or more target group names, specified later in [tcpout:<target_group>] stanzas. * The forwarder sends all data to the specified groups. * If you don't want to forward data automatically, don't set this setting. * Can be overridden by an inputs.conf '_TCP_ROUTING' setting, which in turn can be overridden by a props.conf or transforms.conf modifier. * Starting with version 4.2, this setting is no longer required.
[tcpout:<target_group>]server = [<ip>|<servername>]:<port>, [<ip>|<servername>]:<port>, ... * A comma-separated list of one or more systems to send data to over a TCP socket. * Required if the 'indexerDiscovery' setting is not set. * Typically used to specify receiving Splunk systems, although you can use it to send data to non-Splunk systems (see the 'sendCookedData' setting). * For each system you list, the following information is required: a. The IP address or server name where one or more systems are listening. b. The port on which the syslog server is listening.outputs.conf的更多示例可在以下位置找到：
outputs.conf.example
使用outputs.conf配置转发器
配置后，保存文件并使用从$SPLUNK_HOME/bin运行的以下命令重新启动Splunk
./splunk restart
相关链接
outputs.conf.example使用outputs.conf配置转发器
修订历史记录
| 版本 | 发布日期 | 备注 |
|---|---|---|
1.0 |
28-Sep-2026
|
初始版本 |
反馈