Join the Conversation
- Find Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- Data indexed via REST API then forwarded on to ano...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
If data is being indexed via the Rest API "services/receivers/simple" endpoint vs an entry in inputs.conf , can I still then use outputs.conf to forward the data onto another Indexer ?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The answer is , yes you can 🙂
Just pumped some test data in using the new Java SDK, and outputs.conf routed the event into my Indexer cluster.
Service service = new Service("myhost", 8089);
service.login("admin", "notmyrealpass");
RequestMessage request = new RequestMessage();
request.setContent("testing java sdk");
ResponseMessage response = service.send("receivers/simple?index=testing&source=sdk&sourcetype=sdk_testing", request);
System.out.println(response.getStatus() == 200?"Success":"Failure");
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The answer is , yes you can 🙂
Just pumped some test data in using the new Java SDK, and outputs.conf routed the event into my Indexer cluster.
Service service = new Service("myhost", 8089);
service.login("admin", "notmyrealpass");
RequestMessage request = new RequestMessage();
request.setContent("testing java sdk");
ResponseMessage response = service.send("receivers/simple?index=testing&source=sdk&sourcetype=sdk_testing", request);
System.out.println(response.getStatus() == 200?"Success":"Failure");
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
It's great to know this is possible, but please could you clarify what you put in outputs.conf. Did you have to rely on the defaultGroup setting in the [tcpout] stanza, or do you know a way to have data added using the REST API forwarded using a specific target group other than the default one in outputs.conf?
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Build the Future of Agentic AI: Join the Splunk Agentic Ops Hackathon
[Puzzles] Solve, Learn, Repeat: Character substitutions with Regular Expressions
Splunk Community Badges!
