Getting Data In

Can I replace Splunk Universal Forwarder with Apache NiFi?

gozulin
Communicator

NiFi has a putSplunk processor that should do what I want (send data to an indexer)

BUT it doesn't have any place for me to specify sourcetype, or index, and it only has one "Host" field, whereas I usually use autolb with 2 indexers.

Can I do this? If so, how?

Thanks!

hsesterhenn_spl
Splunk Employee
Splunk Employee

Hi,
a little bit late but...

As far as I understand putSplunk is sending data just using TCP or UDP inputs.

So... this should do the trick on Splunk UFW side...

http://docs.splunk.com/Documentation/Splunk/latest/Data/Monitornetworkports

Remember, that if you want to send different type of data please use different ports and define index and sourcetype in your inputs.conf.

Much better is using Splunk HTTP Event Collector ...

I think it's "AttributeToJSON" then?

HTH,

Holger

0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...