I am trying to use the Protocol Data Inputs (PDI) add-on, but I am having problem getting data to it. What is the best way to receive data from a universal/heavy forwarder instance? I believe the PDI add-on doesn't accept cooked data.
I am currently receiving data from an external Splunk instance. The data are sent to my intermediate forwarder (iFwd), which then forwards to my indexers. This is working fine. Now, I would like to manipulate the data on the iFwd. I have installed the PDI add-on in the iFwd and wanted to know if there was a best solution to get data from a forwarder to the PDI installed on another forwarder.