Can I replace Splunk Universal Forwarder with Apache NiFi?

[gozulin]

NiFi has a putSplunk processor that should do what I want (send data to an indexer)

BUT it doesn't have any place for me to specify sourcetype, or index, and it only has one "Host" field, whereas I usually use autolb with 2 indexers.

Can I do this? If so, how?

Thanks!

[hsesterhenn_spl]

Hi,
a little bit late but...

As far as I understand putSplunk is sending data just using TCP or UDP inputs.

So... this should do the trick on Splunk UFW side...

http://docs.splunk.com/Documentation/Splunk/latest/Data/Monitornetworkports

Remember, that if you want to send different type of data please use different ports and define index and sourcetype in your inputs.conf.

Much better is using Splunk HTTP Event Collector ...

I think it's "AttributeToJSON" then?

HTH,

Holger