Deployment Architecture

Can cooked data be altered again? Or retimestampped?

daniel333
Builder

All,

So I am receiving logs from another Splunk installation that is well cooked. How ever it's not correct, so I am looking to filter said data at a heavy forwarder before letting it into my network. How ever I am finding things like re-sourcetyping is not working. Is there a trick to enabling this?

Tags (1)
0 Karma

somesoni2
SplunkTrust
SplunkTrust

When the cooked data is coming to an Splunk instance (like HF of yours), it doesn't get reparsed again, so any transforms that you want to apply (e.g. sourcetype renaming, filtering etc) would not work. Stating from this post, cooked events are sent by default to the indexQueue and skip the other queues. The setting is in inputs.conf

  $Splunk_Home/etc/system/default/inputs.conf                             
 route = has_key:_replicationBucketUUID:replicationQueue;has_key:_dstrx:typingQueue;has_key:_linebreaker:indexQueue;absent_key:_linebreaker:parsingQueue

Now you can change this behaviour, but it can't be applied to a single sourcetype/source/host. It applies globally and it'll reparse, if already cooked, all data coming to that instance. You can find the value that you need to update to here:

https://answers.splunk.com/answers/97918/reparsing-cooked-data-coming-from-a-heavy-forwarder-possibl...

niketn
Legend

@daniel333 hope you are using the steps similar to the example https://docs.splunk.com/Documentation/Splunk/latest/Data/Advancedsourcetypeoverrides#Example:_Assign...

Also read about routing and filtering data on Splunk Docs

For us to assist you better, please provide some sample events and what you are trying to do also with the configurations props.conf and transforms.conf settings that you have currently setup. Please mock/anonymize any sensitive information.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Using the Splunk Threat Research Team’s Latest Security Content

REGISTER HERE Tech Talk | Security Edition Did you know the Splunk Threat Research Team regularly releases ...