topic Forward Data in Splunk Dev

Forward Data

shangshin — Mon, 28 Sep 2020 12:49:32 GMT

Hi,
I am trying to forward raw data to a none-splunk system by adding an entry at Manager » Forwarding and receiving » Forward data e.g. 10.50.1.1:1111
I also set the option "Yes" in store a local copy of forwarded events.

However, after restarting the splunk server, I don't see any new events get indexed on the splunk UI. On top of, I saw the message "skipped indexing of internal audit event will keep dropping events until indexer congestion is remedied."

Once I deleted the entry in "Forward data", everything is back to normal.
Please note this splunk server is receiving 200 events per second from splunk_universal_forwarder.

Please shed some light on this. Thanks in advance!!!

Error in splunk/var/log/splunk/splunkd.log

11-16-2012 16:38:25.282 -0500 ERROR splunklogger - Uncaught exception in pipeline execution (tcp-output-generic-processor) - getting next event

11-16-2012 16:38:25.283 -0500 ERROR pipeline - Runtime exception in pipeline: indexerPipe, processor: tcp-output-generic-processor, error: vector::_M_range_check

Re: Forward Data

sbrant_splunk — Fri, 16 Nov 2012 21:40:18 GMT

This would be a valid method if you were attempting to forward data to a Splunk indexer. However, since you are sending to a 3rd-party system, this will not work. Since your forwarding system does not recognize the receiving system as Splunk, forwarding will not take place. This document explains how you should configure forwarding to a non-Splunk system:

http://docs.splunk.com/Documentation/Splunk/5.0/Deploy/Forwarddatatothird-partysystemsd

Re: Forward Data

bmacias84 — Fri, 16 Nov 2012 23:17:40 GMT

Keep in mind that UF or LF types do not have the ability to route and filter data by events. A HF is required. Splunk and only send raw events to a third party system.