Implementing Splunk 7, Third Edition - Third Edition

outputs.conf

This configuration controls how Splunk will forward events. In the vast majority of cases, this configuration exists on Splunk forwarders, which send their events to Splunk indexers. An example would look like this:

[tcpout] 
defaultGroup = nyc 
[tcpout:nyc] 
autoLB = true 
server = 1.2.3.4:9997,1.2.3.6:9997 

It is possible to use transforms to route events to different server groups, but it is not commonly used as it introduces a lot of complexity that is generally not needed.