[tcpout]
defautlGroup = primary_indexers
maxQueuSize = 100MB
useACK = true
forceTimebaseAutoLB = true
forwardedindex.2.whitelist = (_audit|_introspection|_internal)

[tcpout:primary_indexers]
server = SRVIDX01.jpit.com:9997, SRVIDX02.jpit.com:9997

#clientCert = $SPLUNK_HOME/etc/auth/server.pem
#sslPassword =