Getting Data In

Forward data received on a port to a third party system

anton085
Path Finder

I have a Splunk instance configured to receive data on port 9997 from 2 forwarders. If I want to configure it to forward data received on port 9997, what should I write as the stanza in props.conf?

For example, to forward data from '/var/log', you have to write:
[source::/var/log]
TRANSFORMS-routing = send_to_tcp

What should I write when the source is the port 9997?

0 Karma
1 Solution

kmorris_splunk
Splunk Employee
Splunk Employee

There is a difference between the receiving port (default 9997) that a forwarder would send data to, and a listening port, say UDP 514 if you are sending syslogs to some port where Splunk is listening for that data stream. All of your data would be coming in to 9997 if it is coming from forwarders. Your source would not reflect the receiving port that the forwarders are sending data to, like it would in the UDP 514 example.

Are you trying to send any data coming from the forwarders on to another destination?

0 Karma

anton085
Path Finder

"Are you trying to send any data coming from the forwarders on to another destination?"

That's exactly what I want to do. Is the props.conf config different for data received on 9997 vs other ports (i.e., 514)?

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Are you trying to send all data to a different destination? Cloning the data or just redirecting?

0 Karma

anton085
Path Finder

I am trying to send the data to a third-party system. I would like to see the configs for both cloning and redirecting.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...