topic Re: UDP input and _TCP_ROUTING - is it possible? in Splunk Search

UDP input and _TCP_ROUTING - is it possible?

andyk — Mon, 14 Feb 2011 21:34:20 GMT

Is it possible to use _TCP_ROUTING with a UDP input? I can not get it to work. My other "monitor" inputs works fine with _TCP_ROUTING. This is a full forwarder not a lwf.

inputs.conf:

[udp://514]
index = testapp
sourcetype = syslog
_TCP_ROUTING = pnlogGroup

outputs.conf:

[tcpout]
defaultGroup = SlogGroup
disabled = false
indexAndForward = 0

[tcpout:pnlogGroup]
disabled = false
server = 10.0.0.41:9997

[tcpout:SlogGroup]
disabled = false
server = 10.0.0.50:9995

Re: UDP input and _TCP_ROUTING - is it possible?

Masa — Fri, 15 Mar 2013 23:35:45 GMT

I think you already got answer a looooooong time ago. Answer is yes. A full Forwarder process data and parse events from udp inputs, and send the processed/parsed to Splunk as you configured in outputs.conf.

Re: UDP input and _TCP_ROUTING - is it possible?

kml_uvce — Sun, 17 Mar 2013 04:01:10 GMT

yes, here you are reciving data via udp but sending data via tcp and both are separated...
-Kamal Bisht

Re: UDP input and _TCP_ROUTING - is it possible?

Masa — Mon, 18 Mar 2013 17:07:35 GMT

What do you mean by "sending data via tcp and both are separated.."?