https://community.splunk.com/t5/Getting-Data-In/Forwarding-logs-to-a-third-party-system-using-a-universal/m-p/277015#M53098 <P>Cooked data is a Splunk proprietary format, for Splunk to Splunk communication.</P> <P>If you are sending to a 3rd party, I dont understand why you need an index our sourcetype, these are Specific to Splunk. What are you trying to integrate the feed with? Have you checked this:</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/6.4.1/Forwarding/Forwarddatatothird-partysystemsd">http://docs.splunk.com/Documentation/Splunk/6.4.1/Forwarding/Forwarddatatothird-partysystemsd</A></P> Thu, 02 Jun 2016 07:47:35 GMT esix_splunk 2016-06-02T07:47:35Z https://community.splunk.com/t5/Getting-Data-In/Forwarding-logs-to-a-third-party-system-using-a-universal/m-p/277012#M53095 <P>Hi All,</P> <P>We are sending logs to a third party system.<BR /> And in the inputs.conf monitor stanza, we have set:</P> <PRE><CODE>sendCookedData = false sourcetype = errorlogs index = logs_index </CODE></PRE> <P><STRONG>sendCookedData = false</STRONG> because we are forwarding logs to a third party system.. (Mentioned in doc)</P> <P>Also, we have set the sourcetype and specified an index..</P> <P>Can we read the sourcetype set for the data at the receiving end?<BR /> For now we are able to see only the plain loglines.</P> <P>Appreciate any help! <BR /> Thanks</P> Wed, 01 Jun 2016 03:46:05 GMT https://community.splunk.com/t5/Getting-Data-In/Forwarding-logs-to-a-third-party-system-using-a-universal/m-p/277012#M53095 immortalraghava 2016-06-01T03:46:05Z https://community.splunk.com/t5/Getting-Data-In/Forwarding-logs-to-a-third-party-system-using-a-universal/m-p/277013#M53096 <P>No. cooked data would include the sourcetype and destination index so if you disable sending cooked data you won't get those details.</P> Wed, 01 Jun 2016 10:35:44 GMT https://community.splunk.com/t5/Getting-Data-In/Forwarding-logs-to-a-third-party-system-using-a-universal/m-p/277013#M53096 jkat54 2016-06-01T10:35:44Z https://community.splunk.com/t5/Getting-Data-In/Forwarding-logs-to-a-third-party-system-using-a-universal/m-p/277014#M53097 <P>Hey thanks for your answer. But cooked data looks like its encoded on the receiving side. Is there a way to decode / retrieve sourcetype from cooked data in a third party receiver ? </P> Thu, 02 Jun 2016 05:48:32 GMT https://community.splunk.com/t5/Getting-Data-In/Forwarding-logs-to-a-third-party-system-using-a-universal/m-p/277014#M53097 immortalraghava 2016-06-02T05:48:32Z https://community.splunk.com/t5/Getting-Data-In/Forwarding-logs-to-a-third-party-system-using-a-universal/m-p/277015#M53098 <P>Cooked data is a Splunk proprietary format, for Splunk to Splunk communication.</P> <P>If you are sending to a 3rd party, I dont understand why you need an index our sourcetype, these are Specific to Splunk. What are you trying to integrate the feed with? Have you checked this:</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/6.4.1/Forwarding/Forwarddatatothird-partysystemsd">http://docs.splunk.com/Documentation/Splunk/6.4.1/Forwarding/Forwarddatatothird-partysystemsd</A></P> Thu, 02 Jun 2016 07:47:35 GMT https://community.splunk.com/t5/Getting-Data-In/Forwarding-logs-to-a-third-party-system-using-a-universal/m-p/277015#M53098 esix_splunk 2016-06-02T07:47:35Z https://community.splunk.com/t5/Getting-Data-In/Forwarding-logs-to-a-third-party-system-using-a-universal/m-p/277016#M53099 <P>Nope, as it is mentioned Splunk cooked data is proprietary. </P> Thu, 02 Jun 2016 10:50:41 GMT https://community.splunk.com/t5/Getting-Data-In/Forwarding-logs-to-a-third-party-system-using-a-universal/m-p/277016#M53099 jkat54 2016-06-02T10:50:41Z