topic Re: TCP vs Splunk cmd in Getting Data In

TCP vs Splunk cmd

Vladimir — Wed, 24 Aug 2011 09:11:08 GMT

Hi all!

I'm a little bit upset with next problem...

If I run some script within splunk (powershell, python, etc) and put something to standard output, the event will be in splunk index and I can do normal search. For example:

Output Message: Metric=MyMetric,Value=MyValue

Search query in splunk: Metric=MyMetric

In this case I can search my event but...

if I send the same event within TCP, the search query can't find anything. It can but only if I use "Metric=MyMetric" (in quotes)

Does anybody know why? And what should I do in this case? Should I send my event in some special format?

Thanks

Re: TCP vs Splunk cmd

Vladimir — Wed, 24 Aug 2011 12:05:56 GMT

I even can't calculate any numeric values (stats sum/avg/mix/max/etc).
Splunk 4.2.2
Splunk Universal Forwarder 4.2.1 (input for tcp)

Re: TCP vs Splunk cmd

ziegfried — Wed, 24 Aug 2011 13:53:01 GMT

That's probably because the data over TCP gets a different sourcetype with different extraction settings (props.conf). Seems like auto-key-value pair extraction is disabled for the particular sourcetype (KV_MODE=none or similar).

Re: TCP vs Splunk cmd

Vladimir — Thu, 25 Aug 2011 09:49:05 GMT

Thanks! It's alive! 🙂