Join the Conversation
- Find Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- Could I send uncooked data to a splunk indexer?
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
In the document I found:
With raw data, ...... This is particularly useful for sending data to a non-Splunk system.
In my case, the server which forwarder was installed has heavy load, and all the log files are zipped.
So the forwarder has to decompress the packages then read the log files and send data to indexer, this consumes extra CPU time, and leads to slow data forwarding.
So I wonder is there a way to tell the forwarder don't decompress the ZIP packages, just send them to indexer and let indexers do the unzip job?
I tried adding "sendCookedData=false" to inputs.conf and restarted the forwarder, but then the indexer refused the connection from the forwarder....
Thanks for anyone may help!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
No, regardless of whether the data would be cooked or not, you can't send data from zip files straight away like that. That data is cooked just means (somewhat simplified) that certain metadata is added to the data stream instead of just sending the raw data. It doesn't affect how the events are read from the sources initially.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
No, regardless of whether the data would be cooked or not, you can't send data from zip files straight away like that. That data is cooked just means (somewhat simplified) that certain metadata is added to the data stream instead of just sending the raw data. It doesn't affect how the events are read from the sources initially.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
That is correct.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi Ayn
Thank you! So there is no way to let forwarder send original zip files to indexer. (Unless using self-made scripts to do the file transferring) Is my understanding right?
And the sendCookedData=false option should only be used when sending data to non-Splunk listener, right?
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Automating Threat Operations and Threat Hunting with Recorded Future
Keep the Learning Going with the New Best of .conf Hub
Splunk Community Badges!
