All Apps and Add-ons

Splunk Applications Protocol (Layer 7)

chintan_shah
Path Finder

Hi,

I need to open the firewall for communication between Iron stream and Splunk. As per the requirement, I am aware that Ironstream will be sending the logs to Splunk via TCP/IP protocol to port. But as per the requirement, i need the Application Protocol which Splunk will use for ingesting the logs on the port.
Can someone help me?

0 Karma

jeastman
Path Finder

Splunk needs to have an input port configured to accept TCP data at the first instance of Splunk receiving that data (could be a UF, HF or Indexer). Addtionally, you will want to make sure that the sourcetype that is coming in (syncsortMF) can understand JSON data. You can just add an addtional stanza to props.conf for the syncsortMF sourcetype and then copy the contents of the JSON stanza. You may want to change the TRUNCATE value to a higher value if you are getting truncated records for the syncsortMF sourcetype after that.

0 Karma

ianhss
Explorer

Hi, Ironstream uses TCP to connect to Splunk. Hope this helps.

Happy to answer any other Ironstream questions.

Alternatively, contact our support team via www.syncsort.com.

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...