topic using forwarder and scripts together in Getting Data In

using forwarder and scripts together

ajitshukla — Mon, 04 Feb 2019 12:02:07 GMT

We have binary data in .dat file and we have converted it to csv format by running scripts on forwarder and have send csv data to splunk instance. But now the requirement is that we should not run scripts on forwarder.
IS there any way to send binary data to splunk through forwarder and then use scripts ( on splunk side)to parse it to csv format ????

Re: using forwarder and scripts together

lakshman239 — Mon, 04 Feb 2019 16:34:35 GMT

Splunk (indexer) can process binay file, if you don't want to pre-process in forwarder. But, generally pre-processing and sending ascii/text is the preferred way.

Can you load the binary file on to a splunk dev instance [ via Data inputs] and see if it can parse and extract fields? If it does and matches your requirement, you can use the generated props.conf and use it in your instance. Also look at the following https://www.splunk.com/blog/2011/07/19/the-naughty-bits-how-to-splunk-binary-logfiles.html

Re: using forwarder and scripts together

somesoni2 — Mon, 04 Feb 2019 16:38:55 GMT

Have a look at this:
https://www.splunk.com/blog/2011/07/19/the-naughty-bits-how-to-splunk-binary-logfiles.html