Getting Data In

Can a custom app send data to the indexer via memory?

ddrillic
Ultra Champion

I wonder what would be an efficient way for a custom app to communicate with an indexer? Can the custom app write to memory somehow and the forwarder will pick it up and send it to the indexer?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The customary way is to write to a file that is monitored by the forwarder. The forwarder to pick up whatever is written to the file and send it to the indexer(s).

---
If this reply helps you, Karma would be appreciated.
0 Karma

ddrillic
Ultra Champion

Right, but let's say you have a heavy duty app. Can it write to memory and the forwarder will pick it up? It's interesting as in the admin course material they show the Deployment Client as a pluggable module. So, conceivably, the deployment can be customized.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

I know of no memory interface to the forwarders.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Building Reliable Asset and Identity Frameworks in Splunk ES

 Accurate asset and identity resolution is the backbone of security operations. Without it, alerts are ...

Cloud Monitoring Console - Unlocking Greater Visibility in SVC Usage Reporting

For Splunk Cloud customers, understanding and optimizing Splunk Virtual Compute (SVC) usage and resource ...

Automatic Discovery Part 3: Practical Use Cases

If you’ve enabled Automatic Discovery in your install of the Splunk Distribution of the OpenTelemetry ...