Archive
Highlighted

UDP input and _TCP_ROUTING - is it possible?

Path Finder

Is it possible to use _TCP_ROUTING with a UDP input? I can not get it to work. My other "monitor" inputs works fine with _TCP_ROUTING. This is a full forwarder not a lwf.

inputs.conf:

[udp://514]
index = testapp
sourcetype = syslog
_TCP_ROUTING = pnlogGroup

outputs.conf:

[tcpout]
defaultGroup = SlogGroup
disabled = false
indexAndForward = 0

[tcpout:pnlogGroup]
disabled = false
server = 10.0.0.41:9997

[tcpout:SlogGroup]
disabled = false
server = 10.0.0.50:9995
Tags (2)
0 Karma
Highlighted

Re: UDP input and _TCP_ROUTING - is it possible?

Splunk Employee
Splunk Employee

I think you already got answer a looooooong time ago. Answer is yes. A full Forwarder process data and parse events from udp inputs, and send the processed/parsed to Splunk as you configured in outputs.conf.

View solution in original post

Highlighted

Re: UDP input and _TCP_ROUTING - is it possible?

Builder

yes, here you are reciving data via udp but sending data via tcp and both are separated...
-Kamal Bisht

0 Karma
Highlighted

Re: UDP input and _TCP_ROUTING - is it possible?

Splunk Employee
Splunk Employee

What do you mean by "sending data via tcp and both are separated.."?

0 Karma