All Apps and Add-ons

Splunk Applications Protocol (Layer 7)

Path Finder

Hi,

I need to open the firewall for communication between Iron stream and Splunk. As per the requirement, I am aware that Ironstream will be sending the logs to Splunk via TCP/IP protocol to port. But as per the requirement, i need the Application Protocol which Splunk will use for ingesting the logs on the port.
Can someone help me?

0 Karma

Path Finder

Splunk needs to have an input port configured to accept TCP data at the first instance of Splunk receiving that data (could be a UF, HF or Indexer). Addtionally, you will want to make sure that the sourcetype that is coming in (syncsortMF) can understand JSON data. You can just add an addtional stanza to props.conf for the syncsortMF sourcetype and then copy the contents of the JSON stanza. You may want to change the TRUNCATE value to a higher value if you are getting truncated records for the syncsortMF sourcetype after that.

0 Karma

Explorer

Hi, Ironstream uses TCP to connect to Splunk. Hope this helps.

Happy to answer any other Ironstream questions.

Alternatively, contact our support team via www.syncsort.com.

0 Karma