Splunk Applications Protocol (Layer 7)

[chintan_shah]

Hi,

I need to open the firewall for communication between Iron stream and Splunk. As per the requirement, I am aware that Ironstream will be sending the logs to Splunk via TCP/IP protocol to port. But as per the requirement, i need the Application Protocol which Splunk will use for ingesting the logs on the port.
Can someone help me?

[jeastman]

Splunk needs to have an input port configured to accept TCP data at the first instance of Splunk receiving that data (could be a UF, HF or Indexer). Addtionally, you will want to make sure that the sourcetype that is coming in (syncsortMF) can understand JSON data. You can just add an addtional stanza to props.conf for the syncsortMF sourcetype and then copy the contents of the JSON stanza. You may want to change the TRUNCATE value to a higher value if you are getting truncated records for the syncsortMF sourcetype after that.

[ianhss]

Hi, Ironstream uses TCP to connect to Splunk. Hope this helps.

Happy to answer any other Ironstream questions.

Alternatively, contact our support team via www.syncsort.com.