topic splunk tcp output format... in Getting Data In

splunk tcp output format...

Steve_Litras — Sat, 23 Oct 2010 00:41:23 GMT

if I wanted to write a receiver for splunk data (i.e. have my index server(s) forward data via tcpout in the outputs.conf), is the format for splunk2splunk traffic published anywhere?

I know it seems like an obscure need, but nonetheless, I've got it. 🙂

Thanks Steve

Re: splunk tcp output format...

ziegfried — Sat, 23 Oct 2010 00:58:07 GMT

Why not just sending out syslog? Consuming this should be quite easy.

Re: splunk tcp output format...

Steve_Litras — Sat, 23 Oct 2010 01:37:30 GMT

The problem with the syslog output is that it just dumps the raw event, no metadata. I need some of the metadata from the cooked event stream.

Re: splunk tcp output format...

ziegfried — Sat, 23 Oct 2010 01:44:30 GMT

Maybe it would be easier to use a script that performs a constant realtime search on the events your're interested in and sends them to the target system.

Re: splunk tcp output format...

mitch_1 — Sat, 23 Oct 2010 07:33:16 GMT

It's not documented, and probably never will be. If you need event metadata you're probably best off with the realtime search suggestion above -- that way you have control about exactly what fields you get.

Re: splunk tcp output format...

southeringtonp — Sat, 23 Oct 2010 08:28:37 GMT

It doesn't look like a tremendously complex protocol. You can always fire up a netcat listener, dump everything to a file, and take a peek.

Of course, there's no guarantee that it won't get changed in the next release of Splunk. Looks like the format is already on version 2.