Splunk Search

How to split cooking data and routing between two (or more) forwarders?

MMCC
Path Finder

Hi all,

I have already read several interesting questions regarding this topic. I'd like to verify which approach is better.

This wiki entry really helps: https://wiki.splunk.com/Community:HowIndexingWorks
(topic 4. Detail Diagram - UF/LWF to Indexer)

Goal: Routing of the data to the indexer layer / specific indexer (Indexer S)
Issue: First forwarder can't communicate with the indexer directly (e.g. security etc.)

I see now two options.

Option A:
I perform nothing with the data on the first (or more) forwarders until I reach the forwarder connected to the IX layer.
-> so to speak pass through the data "raw"

Option B:
I cook the data on the first forwarder and on following forwarders I configure the next "queue" to be "typingQueue".
Which should enable the routing capability of each following forwarder in the line.

See following picture below for details:
alt text

Which approach seems more feasible?

Thank you in advance for any hints and remarks.

Ps. Good input was found here:
https://answers.splunk.com/answers/463643/does-cooked-data-from-a-hf-forwarder-automatically.html

https://answers.splunk.com/answers/97918/reparsing-cooked-data-coming-from-a-heavy-forwarder-possibl...

https://answers.splunk.com/answers/548367/definitions-of-the-route-keys-and-queuenames-for-s.html

0 Karma

richgalloway
SplunkTrust
SplunkTrust

I recommend Option A. Have universal forwarders on endpoints send data to heavy forwarders which pass it on to the indexers.

---
If this reply helps you, Karma would be appreciated.

MMCC
Path Finder

Thank you for the fast reply! I'll further look into Option A.

Do you have any experience with "structured data"?

They seem to be quite special:
https://docs.splunk.com/Documentation/Splunk/8.0.3/Data/Extractfieldsfromfileswithstructureddata

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Please ask that in a new question.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...