Getting Data In

is there any way to process data with a heavy forwarder and then send the formatted data uncooked?

Log_wrangler
Builder

I have raw data that I need to parse / break per event time stamp but I need to send it uncooked (with the event breaks) to a NiFi listener node...

I don't believe this is possible....

Please confirm.
Thank you

Tags (2)
0 Karma
1 Solution

harsmarvania57
SplunkTrust
SplunkTrust

Hi @Log_wrangler,

I believe the same that this is not possible because when you send uncooked data to 3rd party, splunk will send raw data without processing it so in this case you can't break events on those data I guess.

View solution in original post

harsmarvania57
SplunkTrust
SplunkTrust

Hi @Log_wrangler,

I believe the same that this is not possible because when you send uncooked data to 3rd party, splunk will send raw data without processing it so in this case you can't break events on those data I guess.

Log_wrangler
Builder

agreed, its incompatible... thanks.

0 Karma

mstjohn_splunk
Splunk Employee
Splunk Employee

hi @log_wrangler

If this is the correct answer to your question, would you mind approving it? That way, other users can learn from this query. Thanks!

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...