https://community.splunk.com/t5/Splunk-Search/Splunk-data-format/m-p/58525#M14331 <P>What is the Splunk data format of data being forwarded? Splunk website states TCP is format for transmission but its really a protocol for transmission?</P> Mon, 14 Mar 2011 19:06:08 GMT wildbill4 2011-03-14T19:06:08Z https://community.splunk.com/t5/Splunk-Search/Splunk-data-format/m-p/58525#M14331 <P>What is the Splunk data format of data being forwarded? Splunk website states TCP is format for transmission but its really a protocol for transmission?</P> Mon, 14 Mar 2011 19:06:08 GMT https://community.splunk.com/t5/Splunk-Search/Splunk-data-format/m-p/58525#M14331 wildbill4 2011-03-14T19:06:08Z https://community.splunk.com/t5/Splunk-Search/Splunk-data-format/m-p/58526#M14332 <P>The "over the wire" format for Splunk's communications between forwarders and indexers does use TCP as its transport. The "Splunk protocol" inside TCP is Splunk proprietary and (to my knowledge) not documented. </P> <P>If you are planning to build a receiver for Splunk forwarder data, be aware that Splunk can forward over a plain TCP socket to a 3rd party system. See <A href="http://www.splunk.com/base/Documentation/latest/Admin/Forwarddatatothird-partysystems" rel="nofollow">http://www.splunk.com/base/Documentation/latest/Admin/Forwarddatatothird-partysystems</A></P> Mon, 14 Mar 2011 22:25:09 GMT https://community.splunk.com/t5/Splunk-Search/Splunk-data-format/m-p/58526#M14332 dwaddle 2011-03-14T22:25:09Z