All Apps and Add-ons

How to send data from one Splunk forwarder to the Protocol Data Inputs add-on installed on another forwarder?


Hi all,

I am trying to use the Protocol Data Inputs (PDI) add-on, but I am having problem getting data to it. What is the best way to receive data from a universal/heavy forwarder instance? I believe the PDI add-on doesn't accept cooked data.

I am currently receiving data from an external Splunk instance. The data are sent to my intermediate forwarder (iFwd), which then forwards to my indexers. This is working fine. Now, I would like to manipulate the data on the iFwd. I have installed the PDI add-on in the iFwd and wanted to know if there was a best solution to get data from a forwarder to the PDI installed on another forwarder.

0 Karma

Ultra Champion

In theory you could send cooked data to a PDI TCP port , but as this will be binary , you'd need to know the cooked data protocol and write a custom PDI data handler to decode it.

Best just to forward uncooked data from your UF/HF to a TCP port you open in the PDI App.

sendCoookedData = false


Thank you, forgot that you could do that. Working great!!

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...