Getting Data In

Can a custom app send data to the indexer via memory?

ddrillic
Ultra Champion

I wonder what would be an efficient way for a custom app to communicate with an indexer? Can the custom app write to memory somehow and the forwarder will pick it up and send it to the indexer?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The customary way is to write to a file that is monitored by the forwarder. The forwarder to pick up whatever is written to the file and send it to the indexer(s).

---
If this reply helps you, Karma would be appreciated.
0 Karma

ddrillic
Ultra Champion

Right, but let's say you have a heavy duty app. Can it write to memory and the forwarder will pick it up? It's interesting as in the admin course material they show the Deployment Client as a pluggable module. So, conceivably, the deployment can be customized.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

I know of no memory interface to the forwarders.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Index This | When is October more than just the tenth month?

October 2025 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What’s New & Next in Splunk SOAR

 Security teams today are dealing with more alerts, more tools, and more pressure than ever.  Join us for an ...