https://community.splunk.com/t5/Getting-Data-In/How-to-index-a-binary-data-from-UDP/m-p/117558#M24448 <P>You missed the point.</P> <P>You program your own Modular Input listening on it's own UDP port.Think of it like a Splunk UDP proxy. So it can capture and preprocess any type of data(ie: raw bninary) into an appropriate format for Splunk because you are programming it.</P> Wed, 30 Oct 2013 02:01:14 GMT Damien_Dallimor 2013-10-30T02:01:14Z https://community.splunk.com/t5/Getting-Data-In/How-to-index-a-binary-data-from-UDP/m-p/117553#M24443 <P>I am trying to receive a binary data from UDP in splunk, I have tested many method to achieve it, but it still doesn't work. <BR /> I already add a NO_BINARY_CHECK = true in props.conf. </P> <P>Is there anyone have experience on this? </P> Mon, 28 Sep 2020 15:06:07 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-index-a-binary-data-from-UDP/m-p/117553#M24443 matthewgao 2020-09-28T15:06:07Z https://community.splunk.com/t5/Getting-Data-In/How-to-index-a-binary-data-from-UDP/m-p/117554#M24444 <P>Splunk will consume any Human-Readable text, so Binary data is not going to work. You will most likely want to capture that data via UDP and write it to disk in ASCII, and then have Splunk consume the text.</P> Mon, 28 Oct 2013 11:12:59 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-index-a-binary-data-from-UDP/m-p/117554#M24444 alacercogitatus 2013-10-28T11:12:59Z https://community.splunk.com/t5/Getting-Data-In/How-to-index-a-binary-data-from-UDP/m-p/117555#M24445 <P>Did this help you?</P> Tue, 29 Oct 2013 19:28:14 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-index-a-binary-data-from-UDP/m-p/117555#M24445 alacercogitatus 2013-10-29T19:28:14Z https://community.splunk.com/t5/Getting-Data-In/How-to-index-a-binary-data-from-UDP/m-p/117556#M24446 <P>You could write a simple python modular input, that allows users to open up any UDP port, captures the UDP datagram , programmatically decodes the binary data into some textual format, transforms this into events in a best practice logging semantic, and writes these events out to Splunk over STDOUT.</P> Tue, 29 Oct 2013 21:51:53 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-index-a-binary-data-from-UDP/m-p/117556#M24446 Damien_Dallimor 2013-10-29T21:51:53Z https://community.splunk.com/t5/Getting-Data-In/How-to-index-a-binary-data-from-UDP/m-p/117557#M24447 <P>Can it capture the RAW binary data? Splunk seems automatically ignore the binary data.</P> Wed, 30 Oct 2013 01:53:37 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-index-a-binary-data-from-UDP/m-p/117557#M24447 matthewgao 2013-10-30T01:53:37Z https://community.splunk.com/t5/Getting-Data-In/How-to-index-a-binary-data-from-UDP/m-p/117558#M24448 <P>You missed the point.</P> <P>You program your own Modular Input listening on it's own UDP port.Think of it like a Splunk UDP proxy. So it can capture and preprocess any type of data(ie: raw bninary) into an appropriate format for Splunk because you are programming it.</P> Wed, 30 Oct 2013 02:01:14 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-index-a-binary-data-from-UDP/m-p/117558#M24448 Damien_Dallimor 2013-10-30T02:01:14Z https://community.splunk.com/t5/Getting-Data-In/How-to-index-a-binary-data-from-UDP/m-p/117559#M24449 <P>So you mean that I create a UDP listener by myself, Not use the splunkd to listen the UDP</P> Wed, 30 Oct 2013 07:36:01 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-index-a-binary-data-from-UDP/m-p/117559#M24449 matthewgao 2013-10-30T07:36:01Z https://community.splunk.com/t5/Getting-Data-In/How-to-index-a-binary-data-from-UDP/m-p/117560#M24450 <P>Exactly <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Wed, 30 Oct 2013 08:11:31 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-index-a-binary-data-from-UDP/m-p/117560#M24450 Damien_Dallimor 2013-10-30T08:11:31Z https://community.splunk.com/t5/Getting-Data-In/How-to-index-a-binary-data-from-UDP/m-p/117561#M24451 <P>Splunk can not consume binary data, you have to convert it to a splunk readable format before forwarding it to splunk. are you trying to forward netflows to splunk?</P> Wed, 30 Oct 2013 11:57:30 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-index-a-binary-data-from-UDP/m-p/117561#M24451 lphirke 2013-10-30T11:57:30Z https://community.splunk.com/t5/Getting-Data-In/How-to-index-a-binary-data-from-UDP/m-p/117562#M24452 <P>I am trying to forward ipfix to splunk</P> Thu, 31 Oct 2013 05:45:10 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-index-a-binary-data-from-UDP/m-p/117562#M24452 matthewgao 2013-10-31T05:45:10Z https://community.splunk.com/t5/Getting-Data-In/How-to-index-a-binary-data-from-UDP/m-p/117563#M24453 <P>Try out IPFIXify<BR /> <A href="http://www.plixer.com/Products/ipfixify.html">http://www.plixer.com/Products/ipfixify.html</A></P> Thu, 31 Oct 2013 07:01:39 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-index-a-binary-data-from-UDP/m-p/117563#M24453 lphirke 2013-10-31T07:01:39Z