Protobuf data into Splunk

[mloobo]

Hi all,

I have a Java application that sends data using protobuf protocol to an endpoint. The protobuf specification (to be shared with the destination) is compiled as a JAR file. I want to continue using this application but sending data to Splunk.

I already look for this in the Internet, but I did not find anything clear.

Could you please give a set of steps to be able to insert data coming as protobuf messages into Splunk?

Thank you.

[Damien_Dallimor · Accepted solution]

You can use the Protocol Data Inputs App for this purpose.

https://www.splunk.com/blog/2014/11/11/protocol-data-inputs.html

You'll just need to write a custom data handler to decode the received binary using your compiled jar.

Example data handlers ship with the app to get you started. Links in the above blog post.