Getting Data In

is there any way to process data with a heavy forwarder and then send the formatted data uncooked?

Builder

I have raw data that I need to parse / break per event time stamp but I need to send it uncooked (with the event breaks) to a NiFi listener node...

I don't believe this is possible....

Please confirm.
Thank you

Tags (2)
0 Karma
1 Solution

SplunkTrust
SplunkTrust

Hi @Log_wrangler,

I believe the same that this is not possible because when you send uncooked data to 3rd party, splunk will send raw data without processing it so in this case you can't break events on those data I guess.

View solution in original post

SplunkTrust
SplunkTrust

Hi @Log_wrangler,

I believe the same that this is not possible because when you send uncooked data to 3rd party, splunk will send raw data without processing it so in this case you can't break events on those data I guess.

View solution in original post

Builder

agreed, its incompatible... thanks.

0 Karma

Splunk Employee
Splunk Employee

hi @log_wrangler

If this is the correct answer to your question, would you mind approving it? That way, other users can learn from this query. Thanks!

0 Karma