What is the identification process for SplunkForwarder?

[agentsofshield]

I've been asked to write a document about the process of SplunkForwarder connecting with a deployer or indexer and forwarding data.

I've been browsing Splunk docs for an hour or two and all I see is configuration / troubleshooting tutorials.

What is the identification process step by step?

I'm guessing it's something like: heartbeat > enlistment > application push > data push, but I'm not sure myself and I hope you guys have a better, more detailed explanation for me.

[richgalloway · Accepted solution]

The forwarder communicates with a few Splunk processes, not necessarily in this order.

1. If configured as a deployment client, it contacts its Deployment Server and requests a list of apps to download. It downloads those apps and restarts itself as necessary.
2. If Indexer Discovery is enabled, it contacts the Master Node to get a list of indexers. Otherwise, it gets the indexer list from its own outputs.conf file.
3. It opens the first indexer in its list and starts sending data. If that indexer is not available, the forwarder will try the others on its list.
4. Periodically, the forwarder will close the connection to its indexer and open a new connection to another indexer. When it does this is controlled by several settings.

As for the protocol between the forwarder and the other processes, well, its proprietary so you're not likely to find documentation on it. Wireshark may be your best friend for help with that.

[agentsofshield]

Thanks for the thorough explanation.