All Apps and Add-ons

Splunk Applications Protocol (Layer 7)

chintan_shah
Path Finder

Hi,

I need to open the firewall for communication between Iron stream and Splunk. As per the requirement, I am aware that Ironstream will be sending the logs to Splunk via TCP/IP protocol to port. But as per the requirement, i need the Application Protocol which Splunk will use for ingesting the logs on the port.
Can someone help me?

0 Karma

jeastman
Path Finder

Splunk needs to have an input port configured to accept TCP data at the first instance of Splunk receiving that data (could be a UF, HF or Indexer). Addtionally, you will want to make sure that the sourcetype that is coming in (syncsortMF) can understand JSON data. You can just add an addtional stanza to props.conf for the syncsortMF sourcetype and then copy the contents of the JSON stanza. You may want to change the TRUNCATE value to a higher value if you are getting truncated records for the syncsortMF sourcetype after that.

0 Karma

ianhss
Explorer

Hi, Ironstream uses TCP to connect to Splunk. Hope this helps.

Happy to answer any other Ironstream questions.

Alternatively, contact our support team via www.syncsort.com.

0 Karma
Get Updates on the Splunk Community!

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...

Security Highlights | January 2023 Newsletter

January 2023 Splunk Security Essentials (SSE) 3.7.0 ReleaseThe free Splunk Security Essentials (SSE) 3.7.0 app ...

Platform Highlights | January 2023 Newsletter

 January 2023Peace on Earth and Peace of Mind With Business ResilienceAll organizations can start the new year ...