Getting Data In

route attribute in inputs.conf

splunkn
Communicator

Can someone could explain the route attribute in inputs.conf

[splunktcp]
route = haskey..

What is matching rule here mentioned

Tags (2)
0 Karma

Jeremiah
Motivator

The only time I've seen that setting used is when you want to re-parse cooked data. If you have data from a heavy forwarder going to an indexer, normally none of the indexer's index time props and transforms apply. This is because the data has already been 'cooked' (processed) by the heavy forwarder. You can change the route to force data to pass through parsing queues it would normally skip.

https://answers.splunk.com/answers/97918/reparsing-cooked-data-coming-from-a-heavy-forwarder-possibl...
https://answers.splunk.com/answers/305740/why-is-data-received-from-a-remote-splunk-instance.html
https://answers.splunk.com/answers/5528/forwarding-select-data-in-my-environment.html

Don't confuse this setting with more commonly used data routing settings, where you might want to forward some data to a 3rd party, to a different set of indexers, or drop a subset of events:

http://docs.splunk.com/Documentation/Splunk/6.4.2/Forwarding/Routeandfilterdatad

Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Best Practices: Splunk auto adjust pipeline queue

When you enable autoAdjustQueue in Splunk, maxSize should be understood as the queue size Splunk starts with ...

Laser Bananas and Edge Hubs: Exploring Operational Technology (OT) Data Through a ...

  OT is a different environment to traditional IT and can have interesting challenges when interfacing the ...

Event Series: Mastering AI Tokenomics and Splunk Agent Observability

Beyond the Black Box: Correlating AI Performance and Tokenomics with Splunk Agent Observability   As ...