Getting Data In

Can a custom app send data to the indexer via memory?

ddrillic
Ultra Champion

I wonder what would be an efficient way for a custom app to communicate with an indexer? Can the custom app write to memory somehow and the forwarder will pick it up and send it to the indexer?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The customary way is to write to a file that is monitored by the forwarder. The forwarder to pick up whatever is written to the file and send it to the indexer(s).

---
If this reply helps you, Karma would be appreciated.
0 Karma

ddrillic
Ultra Champion

Right, but let's say you have a heavy duty app. Can it write to memory and the forwarder will pick it up? It's interesting as in the admin course material they show the Deployment Client as a pluggable module. So, conceivably, the deployment can be customized.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

I know of no memory interface to the forwarders.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

How much can you really learn in 3 minutes?

Observability can certainly be hard to understand – there's a lot of jargon and buzzwords and it seems to ...

Event Series: The Agentic SOC: Trust Before Autonomy

AI is fundamentally changing security operations, but true progress requires more than just automation—it ...

Free Professional Services for .conf26 Attendees

This year at .conf26, we are doing something a little different. We are bringing the best minds from ...