Splunk integration with third party systems

Deployment Architecture

Hi All,

To forward data to third-party systems, integrated splunk agent with below configs.

Third party is able to receive data by listening on TCP port.

Issue: Unable to view default internal fields like source or host required for data enrichment.

Tried adding host and source in inputs.conf, but no luck.

Is there any limitation for forwarding internal fields to third party systems?

inputs.conf

[blacklist:$SPLUNK_HOME/var/log/splunk]

[monitor:///tmp/test1.log]

_TCP_ROUTING = App1Group

outputs.conf

[tcpout:App1Group]

server=<ip address>:<port>

sendCookedData = false

Get Updates on the Splunk Community!

Thank you, Splunk Community, for making .conf26 in Denver one for the books. From packed Splunk University ...

When you enable autoAdjustQueue in Splunk, maxSize should be understood as the queue size Splunk starts with ...

Why this feature matters Many Splunk environments experience ingestion pressure long before the host is fully ...

Join the Conversation