Archive

How to split cooking data and routing between two (or more) forwarders?

Path Finder

Hi all,

I have already read several interesting questions regarding this topic. I'd like to verify which approach is better.

This wiki entry really helps: https://wiki.splunk.com/Community:HowIndexingWorks
(topic 4. Detail Diagram - UF/LWF to Indexer)

Goal: Routing of the data to the indexer layer / specific indexer (Indexer S)
Issue: First forwarder can't communicate with the indexer directly (e.g. security etc.)

I see now two options.

Option A:
I perform nothing with the data on the first (or more) forwarders until I reach the forwarder connected to the IX layer.
-> so to speak pass through the data "raw"

Option B:
I cook the data on the first forwarder and on following forwarders I configure the next "queue" to be "typingQueue".
Which should enable the routing capability of each following forwarder in the line.

See following picture below for details:
alt text

Which approach seems more feasible?

Thank you in advance for any hints and remarks.

Ps. Good input was found here:
https://answers.splunk.com/answers/463643/does-cooked-data-from-a-hf-forwarder-automatically.html

https://answers.splunk.com/answers/97918/reparsing-cooked-data-coming-from-a-heavy-forwarder-possibl...

https://answers.splunk.com/answers/548367/definitions-of-the-route-keys-and-queuenames-for-s.html

0 Karma

SplunkTrust
SplunkTrust

I recommend Option A. Have universal forwarders on endpoints send data to heavy forwarders which pass it on to the indexers.

---
If this reply helps you, an upvote would be appreciated.

Path Finder

Thank you for the fast reply! I'll further look into Option A.

Do you have any experience with "structured data"?

They seem to be quite special:
https://docs.splunk.com/Documentation/Splunk/8.0.3/Data/Extractfieldsfromfileswithstructureddata

0 Karma

SplunkTrust
SplunkTrust

Please ask that in a new question.

---
If this reply helps you, an upvote would be appreciated.
0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!