topic Re: Universal forwarder sending "Cooked" data to indexer in Getting Data In

Universal forwarder sending "Cooked" data to indexer

arapozo — Tue, 29 Mar 2011 04:03:11 GMT

Trying to find a solution to my problem:

http://answers.splunk.com/questions/13139/wineventlogsecurity-filtering-does-not-work

I've checked my metris.log file and I think I've found the problem, all my universal forwarders are connecting sending cooked data:

03-28-2011 16:53:54.609 -0400 INFO  Metrics - group=tcpin_connections, xxx.xxx.xxxx.xxxx:3244:9995, connectionType=cooked, sourcePort=3244, sourceHost=xxx.xxx.xxxx.xxxx, sourceIp=xxx.xxx.xxxx.xxxx, destPort=9995, _tcp_Bps=53.03, _tcp_KBps=0.05, _tcp_avg_thruput=0.01, kb=1.61, _tcp_Kprocessed=13.00, _tcp_eps=0.10, build=96430, version=4.2, os=Windows, arch=Intel, hostname=SERVERNAME, guid=933005E8-DBF9-4567-827A-E1D13E264568, fwdType=uf, ssl=false, lastIndexer=xxx.xxx.xxxx.xxxx:9995, ack=false

Isn't a universal forwarder suposed to send unparsed data? If my indexer sees cooked data it won't apply any transforms to it. What can I do about this?

Re: Universal forwarder sending "Cooked" data to indexer

Steve_G_ — Tue, 29 Mar 2011 04:49:41 GMT

The universal forwarder does send unparsed data. In this context, "cooked" merely means that blocks of data have been tagged with default fields, such as source, sourcetype and host. Both parsed and unparsed data are considered "cooked":

http://www.splunk.com/base/Documentation/latest/Deploy/Aboutforwardingandreceivingdata#Types_of_data

"Raw" data is totally unprocessed -- no tagging at all.

Re: Universal forwarder sending "Cooked" data to indexer

arapozo — Tue, 29 Mar 2011 05:20:35 GMT

Thank you, wasn't aware of that fact.