splunk tcp output format...

[Steve_Litras]

if I wanted to write a receiver for splunk data (i.e. have my index server(s) forward data via tcpout in the outputs.conf), is the format for splunk2splunk traffic published anywhere?

I know it seems like an obscure need, but nonetheless, I've got it. 🙂

Thanks Steve

[ziegfried · Accepted solution]

Why not just sending out syslog? Consuming this should be quite easy.

[southeringtonp]

It doesn't look like a tremendously complex protocol. You can always fire up a netcat listener, dump everything to a file, and take a peek.

Of course, there's no guarantee that it won't get changed in the next release of Splunk. Looks like the format is already on version 2.

[mitch_1 · Accepted solution]

It's not documented, and probably never will be. If you need event metadata you're probably best off with the realtime search suggestion above -- that way you have control about exactly what fields you get.

[ziegfried · Accepted solution]

Why not just sending out syslog? Consuming this should be quite easy.

[ziegfried]

Maybe it would be easier to use a script that performs a constant realtime search on the events your're interested in and sends them to the target system.

[Steve_Litras]

The problem with the syslog output is that it just dumps the raw event, no metadata. I need some of the metadata from the cooked event stream.