Getting Data In

Can I replace Splunk Universal Forwarder with Apache NiFi?

gozulin
Communicator

NiFi has a putSplunk processor that should do what I want (send data to an indexer)

BUT it doesn't have any place for me to specify sourcetype, or index, and it only has one "Host" field, whereas I usually use autolb with 2 indexers.

Can I do this? If so, how?

Thanks!

hsesterhenn_spl
Splunk Employee
Splunk Employee

Hi,
a little bit late but...

As far as I understand putSplunk is sending data just using TCP or UDP inputs.

So... this should do the trick on Splunk UFW side...

http://docs.splunk.com/Documentation/Splunk/latest/Data/Monitornetworkports

Remember, that if you want to send different type of data please use different ports and define index and sourcetype in your inputs.conf.

Much better is using Splunk HTTP Event Collector ...

I think it's "AttributeToJSON" then?

HTH,

Holger

0 Karma
Get Updates on the Splunk Community!

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...