https://community.splunk.com/t5/Deployment-Architecture/Univarsal-Forwarder-to-Heavy-Forwarder-then-convert-Binary-data/m-p/454580#M21921 <P>1.My universal forwarder sending Binary data to Heavy Forwarder in Index name as "Binary_index" .<BR /> 2.On heavy Forwarder I want to convert these Binary data to csv format,for which I have written python script and then send CSV data to splunk instance.</P> <P>But I don't know I to achieve this<BR /> please provide me solution with configuration files details for every steps.</P> <P>It would be great help if you provide detailed solution for this,since I am new to splunk .</P> <P>please provide the configuration files details for reading binary data on universal forwarder side.</P> Wed, 06 Feb 2019 13:01:05 GMT ajitshukla 2019-02-06T13:01:05Z https://community.splunk.com/t5/Deployment-Architecture/Univarsal-Forwarder-to-Heavy-Forwarder-then-convert-Binary-data/m-p/454580#M21921 <P>1.My universal forwarder sending Binary data to Heavy Forwarder in Index name as "Binary_index" .<BR /> 2.On heavy Forwarder I want to convert these Binary data to csv format,for which I have written python script and then send CSV data to splunk instance.</P> <P>But I don't know I to achieve this<BR /> please provide me solution with configuration files details for every steps.</P> <P>It would be great help if you provide detailed solution for this,since I am new to splunk .</P> <P>please provide the configuration files details for reading binary data on universal forwarder side.</P> Wed, 06 Feb 2019 13:01:05 GMT https://community.splunk.com/t5/Deployment-Architecture/Univarsal-Forwarder-to-Heavy-Forwarder-then-convert-Binary-data/m-p/454580#M21921 ajitshukla 2019-02-06T13:01:05Z https://community.splunk.com/t5/Deployment-Architecture/Univarsal-Forwarder-to-Heavy-Forwarder-then-convert-Binary-data/m-p/454581#M21922 <P>@ajitshukla</P> <P>I think you can save it using outlookup command. and can normally forward the data to splunk instance.</P> Wed, 06 Feb 2019 13:34:54 GMT https://community.splunk.com/t5/Deployment-Architecture/Univarsal-Forwarder-to-Heavy-Forwarder-then-convert-Binary-data/m-p/454581#M21922 vishaltaneja070 2019-02-06T13:34:54Z https://community.splunk.com/t5/Deployment-Architecture/Univarsal-Forwarder-to-Heavy-Forwarder-then-convert-Binary-data/m-p/454582#M21923 <P>how we can save binary data using outlookup command and convert it to csv using my python script and send it to splunk instance</P> Thu, 07 Feb 2019 05:35:27 GMT https://community.splunk.com/t5/Deployment-Architecture/Univarsal-Forwarder-to-Heavy-Forwarder-then-convert-Binary-data/m-p/454582#M21923 ajitshukla 2019-02-07T05:35:27Z https://community.splunk.com/t5/Deployment-Architecture/Univarsal-Forwarder-to-Heavy-Forwarder-then-convert-Binary-data/m-p/454583#M21924 <P>Hi Team,</P> <P>how we can save binary data using outlookup command and convert it to csv using my python script and send it to splunk instance</P> Thu, 07 Feb 2019 05:56:37 GMT https://community.splunk.com/t5/Deployment-Architecture/Univarsal-Forwarder-to-Heavy-Forwarder-then-convert-Binary-data/m-p/454583#M21924 1206chandra 2019-02-07T05:56:37Z https://community.splunk.com/t5/Deployment-Architecture/Univarsal-Forwarder-to-Heavy-Forwarder-then-convert-Binary-data/m-p/454584#M21925 <P>There are two things: (for the below approach there is no need to python script)<BR /> 1. First you can locally index the data and send it to some other server as well. Check the below link:<BR /> <A href="https://docs.splunk.com/Documentation/Splunk/7.2.3/Forwarding/Routeandfilterdatad">https://docs.splunk.com/Documentation/Splunk/7.2.3/Forwarding/Routeandfilterdatad</A><BR /> 2. Now after data is indexed, you can schedule a report in Splunk where you can outputlookup search results in csv.</P> Thu, 07 Feb 2019 08:50:40 GMT https://community.splunk.com/t5/Deployment-Architecture/Univarsal-Forwarder-to-Heavy-Forwarder-then-convert-Binary-data/m-p/454584#M21925 vishaltaneja070 2019-02-07T08:50:40Z https://community.splunk.com/t5/Deployment-Architecture/Univarsal-Forwarder-to-Heavy-Forwarder-then-convert-Binary-data/m-p/454585#M21926 <P>but converting binary data to csv logic is inside python script ,So I have to use this python script for binary to csv conversion</P> Mon, 11 Feb 2019 05:50:06 GMT https://community.splunk.com/t5/Deployment-Architecture/Univarsal-Forwarder-to-Heavy-Forwarder-then-convert-Binary-data/m-p/454585#M21926 ajitshukla 2019-02-11T05:50:06Z https://community.splunk.com/t5/Deployment-Architecture/Univarsal-Forwarder-to-Heavy-Forwarder-then-convert-Binary-data/m-p/454586#M21927 <P>@ajitshukla </P> <P>Thats what i am saying there is no need to convert using python. You can do the same login on SPL and send the result using outputlookup.</P> Mon, 11 Feb 2019 07:04:34 GMT https://community.splunk.com/t5/Deployment-Architecture/Univarsal-Forwarder-to-Heavy-Forwarder-then-convert-Binary-data/m-p/454586#M21927 vishaltaneja070 2019-02-11T07:04:34Z