All Apps and Add-ons

How to send data from one Splunk forwarder to the Protocol Data Inputs add-on installed on another forwarder?


Hi all,

I am trying to use the Protocol Data Inputs (PDI) add-on, but I am having problem getting data to it. What is the best way to receive data from a universal/heavy forwarder instance? I believe the PDI add-on doesn't accept cooked data.

I am currently receiving data from an external Splunk instance. The data are sent to my intermediate forwarder (iFwd), which then forwards to my indexers. This is working fine. Now, I would like to manipulate the data on the iFwd. I have installed the PDI add-on in the iFwd and wanted to know if there was a best solution to get data from a forwarder to the PDI installed on another forwarder.

0 Karma

Ultra Champion

In theory you could send cooked data to a PDI TCP port , but as this will be binary , you'd need to know the cooked data protocol and write a custom PDI data handler to decode it.

Best just to forward uncooked data from your UF/HF to a TCP port you open in the PDI App.

sendCoookedData = false


Thank you, forgot that you could do that. Working great!!

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Updates (ESCU) - New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 3 releases of new content via the Enterprise ...

Thought Leaders are Validating Your Hard Work and Training Rigor

As a Splunk enthusiast and member of the Splunk Community, you are one of thousands who recognize the value of ...

.conf23 Registration is Now Open!

Time to toss the .conf-etti 🎉 —  .conf23 registration is open!   Join us in Las Vegas July 17-20 for ...