https://community.splunk.com/t5/Getting-Data-In/Can-forwarded-data-be-customized/m-p/425163#M95087 <P>Being inspired by this <A href="https://github.com/kospol/splunk_simplePythonModularInput">sample</A> I've developed my own modular input which loads data, parse it and after imports it to my Splunk Heavy Forwarder instance. <BR /> Now I plan to forward data from HF to a splunk instance (and maybe a 3rd party splunk instance), but I'd like to process it before forwarding it - there is any way to preprocess forwarded data? </P> Thu, 13 Jun 2019 14:25:04 GMT dreadangel 2019-06-13T14:25:04Z https://community.splunk.com/t5/Getting-Data-In/Can-forwarded-data-be-customized/m-p/425163#M95087 <P>Being inspired by this <A href="https://github.com/kospol/splunk_simplePythonModularInput">sample</A> I've developed my own modular input which loads data, parse it and after imports it to my Splunk Heavy Forwarder instance. <BR /> Now I plan to forward data from HF to a splunk instance (and maybe a 3rd party splunk instance), but I'd like to process it before forwarding it - there is any way to preprocess forwarded data? </P> Thu, 13 Jun 2019 14:25:04 GMT https://community.splunk.com/t5/Getting-Data-In/Can-forwarded-data-be-customized/m-p/425163#M95087 dreadangel 2019-06-13T14:25:04Z https://community.splunk.com/t5/Getting-Data-In/Can-forwarded-data-be-customized/m-p/425164#M95088 <P>I consider the parsing your modular input does to be "preprocessing". What additional processing do you want to do?</P> Thu, 13 Jun 2019 16:48:56 GMT https://community.splunk.com/t5/Getting-Data-In/Can-forwarded-data-be-customized/m-p/425164#M95088 richgalloway 2019-06-13T16:48:56Z https://community.splunk.com/t5/Getting-Data-In/Can-forwarded-data-be-customized/m-p/425165#M95089 <P>my target is add alert upon forwarded messages.<BR /> Kind of - if forwarded event's field type is 5, the forwarding module should call an REST API and additionally forward the event to a second receiver....</P> Fri, 14 Jun 2019 05:23:51 GMT https://community.splunk.com/t5/Getting-Data-In/Can-forwarded-data-be-customized/m-p/425165#M95089 dreadangel 2019-06-14T05:23:51Z