Getting Data In

Props and Transforms doubt

Karthikeya
Path Finder

I am new to Splunk admin and please explain this following stanzas:

We have a dedicated syslog server which receives the logs from network devices and UF installed on the server forwards the data to our cluster manager. These configs are in cluster manager under manager apps.

0 Karma

Karthikeya
Path Finder

Thank you @sainag_splunk ..

Then what about inputs.conf and outputs.conf (i believe it will not be there considering it's indexer) in indexer cluster should be configured?

We have deployment server as well. Can you please let me know where it will be there in picture?

sainag_splunk
Splunk Employee
Splunk Employee
  1. Data Flow:

Data goes DIRECTLY from UF to indexers on port 9997 (not to cluster manager)

Cluster Manager only handles configuration distribution

  1. Configuration Management:

Props and transforms configs are deployed via cluster manager

These configs are pushed to index peers via index cluster bundle

  1. Processing Location:

All parsing happens on the indexers (index peers)

Each indexer applies the deployed configurations independently

For Deep Understanding: Refer: https://community.splunk.com/t5/Getting-Data-In/Diagrams-of-how-indexing-works-in-the-Splunk-platfor...

  • Review props.conf documentation: docs.splunk.com/Documentation/Splunk/9.1.0/Admin/Propsconf
  •  docs.splunk.com/Documentation/ITSI/4.17.0/Configure/transforms.conf

Since there are many pipeline components, I encourage you to read through these resources for a complete understanding.

Simple Data Flow here.

Screenshot 2024-11-12 at 5.55.15 PM.png



If this Helps, Please Upvote.

Karthikeya
Path Finder

Hi @sainag_splunk ,

Also please explain what is index peers you mean and index cluster bundle?

Please reply

0 Karma

sainag_splunk
Splunk Employee
Splunk Employee

@Karthikeya Index peers are simply indexers that work together in a Splunk cluster environment. They are responsible for receiving, processing, and storing data while maintaining copies across multiple indexers for redundancy and high availability. When a Cluster Master pushes configuration changes through an index cluster bundle, all index peers receive the same settings to ensure consistent operation across the cluster.

Refer: https://docs.splunk.com/Documentation/Splunk/9.3.2/Indexer/Basicclusterarchitecture
https://docs.splunk.com/Documentation/Splunk/9.3.2/Indexer/Howclusteredindexingworks



If this Helps, Please Upvote and Mark as solved.

Screenshot 2024-11-18 at 10.30.11 AM.png

Get Updates on the Splunk Community!

Buttercup Games: Further Dashboarding Techniques

Hello! We are excited to kick off a new series of blogs from SplunkTrust member ITWhisperer, who demonstrates ...

Message Parsing in SOCK

Introduction This blog post is part of an ongoing series on SOCK enablement. In this blog post, I will write ...

Exploring the OpenTelemetry Collector’s Kubernetes annotation-based discovery

We’ve already explored a few topics around observability in a Kubernetes environment -- Common Failures in a ...