All Apps and Add-ons

Splunk Applications Protocol (Layer 7)

chintan_shah
Path Finder

Hi,

I need to open the firewall for communication between Iron stream and Splunk. As per the requirement, I am aware that Ironstream will be sending the logs to Splunk via TCP/IP protocol to port. But as per the requirement, i need the Application Protocol which Splunk will use for ingesting the logs on the port.
Can someone help me?

0 Karma

jeastman
Path Finder

Splunk needs to have an input port configured to accept TCP data at the first instance of Splunk receiving that data (could be a UF, HF or Indexer). Addtionally, you will want to make sure that the sourcetype that is coming in (syncsortMF) can understand JSON data. You can just add an addtional stanza to props.conf for the syncsortMF sourcetype and then copy the contents of the JSON stanza. You may want to change the TRUNCATE value to a higher value if you are getting truncated records for the syncsortMF sourcetype after that.

0 Karma

ianhss
Explorer

Hi, Ironstream uses TCP to connect to Splunk. Hope this helps.

Happy to answer any other Ironstream questions.

Alternatively, contact our support team via www.syncsort.com.

0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...