topic Re: Where can I find a complete list of data source types that can be indexed in Splunk? in Getting Data In

Where can I find a complete list of data source types that can be indexed in Splunk?

kartvasilii — Thu, 02 Oct 2014 09:45:53 GMT

Hi,
Could you tell me, do you have sort of "list of supported data sources"?
Actually, I want to know complete list of connectors to data source types supported in Splunk Enterprise.
Thanks!

Re: Where can I find a complete list of data source types that can be indexed in Splunk?

MarioM — Thu, 02 Oct 2014 10:29:05 GMT

With Splunk there is no such thing as "list of supported data sources" as:
- we take any ascii data
- we have schema on the fly where data knowledge happened at search time and can be modified/created at anytime.http://docs.splunk.com/Documentation/Splunk/6.1.4/Knowledge/WhatisSplunkknowledge
- we have nearly 600 apps providing data knowledge,reports and dashboards. https://apps.splunk.com

Re: Where can I find a complete list of data source types that can be indexed in Splunk?

kartvasilii — Thu, 02 Oct 2014 10:48:41 GMT

So, Can Splunk take any type of data from any type of sources (juniper, cisco, RADIUS, ...)?

Re: Where can I find a complete list of data source types that can be indexed in Splunk?

kartvasilii — Thu, 02 Oct 2014 11:00:11 GMT

In other words, I want to know, what kind of data and from what kind of sources (I mean OS (Windows, Linux,...), Network Devices (Cisco, Juniper, ...) ...) can be received by a Splunk Indexer?

Re: Where can I find a complete list of data source types that can be indexed in Splunk?

MarioM — Thu, 02 Oct 2014 11:08:56 GMT

any kind from the moment it is ascii and you have a mechanism to collect it: http://docs.splunk.com/Documentation/Splunk/6.1.4/Data/WhatSplunkcanmonitor

Re: Where can I find a complete list of data source types that can be indexed in Splunk?

MuS — Thu, 02 Oct 2014 12:35:11 GMT

as addition:

There is a full list of known/pretrained sourcetypes available on docs http://docs.splunk.com/Documentation/Splunk/6.1.4/Data/Listofpretrainedsourcetypes

Re: Where can I find a complete list of data source types that can be indexed in Splunk?

kartvasilii — Thu, 02 Oct 2014 12:38:12 GMT

Ok, In this case
Could you tell me, do you have a list of available collection mechanism?
Sort of:
Remote collection:
* ODBS
* SSH/Telnet
* ...
Local collection:
* Windows files
* Linux files
* ...
Passive collection:
* SNMP
* SysLog
* NetFlow
* ...

Re: Where can I find a complete list of data source types that can be indexed in Splunk?

MuS — Thu, 02 Oct 2014 14:16:38 GMT

http://docs.splunk.com/Documentation/Splunk/6.1.4/Data/WhatSplunkcanmonitor#Types_of_data_sources

Re: Where can I find a complete list of data source types that can be indexed in Splunk?

kartvasilii — Fri, 03 Oct 2014 08:17:41 GMT

How I understood from this documentation:
1. Splunk doesn't support netflow (or other protocols)?
2. Splunk doesn't suppor ODBC or JDBS?
3. Splunk doesn't support SSH/Telnet?

Is this right?

Re: Where can I find a complete list of data source types that can be indexed in Splunk?

Ayn — Fri, 03 Oct 2014 09:56:47 GMT

Splunk supports scripted inputs which means you're totally free to implement whatever input type you like. There's an app for for netflow, so it supports netflow. There's an app for grabbing database input and there's an ODBC driver that you can use, so it supports that. I don't know how you would expect to index anything using telnet.

Re: Where can I find a complete list of data source types that can be indexed in Splunk?

kartvasilii — Fri, 03 Oct 2014 10:14:02 GMT

Thanks for the information Ayn.
Let me change my question.
What kind of collection mechanisms Splunk Enterprise supports from-the-box (without apps instalation)?

Re: Where can I find a complete list of data source types that can be indexed in Splunk?

kartvasilii — Fri, 03 Oct 2014 10:20:35 GMT

How I understood, it supports:
1. Files\Directories monitoring (remote and local)
2. Windows Event Log collection (local via event log channels and remote via WMI)
3. Windows Performance Monitoring (local via PHD API and remote via WMI)
4. AD changes monitoring
5. Local Windows Registry cahnges
6. SNMP traps.
7. Data collection from UDP and TCP ports
8. Collection data from FIFO
9. Scripted Inputs (remote and local)

Sorry, if I made a mistake

Re: Where can I find a complete list of data source types that can be indexed in Splunk?

MarioM — Fri, 03 Oct 2014 15:33:53 GMT

if you are doing a competitive analysis i would recommend you to contact splunk Sales Engineering team as they will have plenty of infos to share with you

Re: Where can I find a complete list of data source types that can be indexed in Splunk?

DUThibault — Fri, 24 Nov 2017 15:14:55 GMT

MarioM is being much too restrictive: Splunk can consume any text data, not just ASCII. UTF-8 is well-supported, for instance. See [https://answers.splunk.com/answers/137342/splunk-cannot-index-and-search-charset-utf-8-without-bom.html this answer] where it is mentioned one can add CHARSET to the props.conf of any source input.