All Apps and Add-ons

How to send data from one Splunk forwarder to the Protocol Data Inputs add-on installed on another forwarder?

OL
Communicator

Hi all,

I am trying to use the Protocol Data Inputs (PDI) add-on, but I am having problem getting data to it. What is the best way to receive data from a universal/heavy forwarder instance? I believe the PDI add-on doesn't accept cooked data.

I am currently receiving data from an external Splunk instance. The data are sent to my intermediate forwarder (iFwd), which then forwards to my indexers. This is working fine. Now, I would like to manipulate the data on the iFwd. I have installed the PDI add-on in the iFwd and wanted to know if there was a best solution to get data from a forwarder to the PDI installed on another forwarder.

0 Karma

Damien_Dallimor
Ultra Champion

In theory you could send cooked data to a PDI TCP port , but as this will be binary , you'd need to know the cooked data protocol and write a custom PDI data handler to decode it.

Best just to forward uncooked data from your UF/HF to a TCP port you open in the PDI App.

sendCoookedData = false

http://docs.splunk.com/Documentation/Splunk/6.1/admin/Outputsconf

OL
Communicator

Thank you, forgot that you could do that. Working great!!

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...