Getting Data In

splunk tcp output format...

Path Finder

if I wanted to write a receiver for splunk data (i.e. have my index server(s) forward data via tcpout in the outputs.conf), is the format for splunk2splunk traffic published anywhere?

I know it seems like an obscure need, but nonetheless, I've got it. 🙂

Thanks Steve

Tags (1)
2 Solutions

Influencer

Why not just sending out syslog? Consuming this should be quite easy.

View solution in original post

Splunk Employee
Splunk Employee

It's not documented, and probably never will be. If you need event metadata you're probably best off with the realtime search suggestion above -- that way you have control about exactly what fields you get.

View solution in original post

Motivator

It doesn't look like a tremendously complex protocol. You can always fire up a netcat listener, dump everything to a file, and take a peek.

Of course, there's no guarantee that it won't get changed in the next release of Splunk. Looks like the format is already on version 2.

0 Karma

Splunk Employee
Splunk Employee

It's not documented, and probably never will be. If you need event metadata you're probably best off with the realtime search suggestion above -- that way you have control about exactly what fields you get.

View solution in original post

Influencer

Why not just sending out syslog? Consuming this should be quite easy.

View solution in original post

Influencer

Maybe it would be easier to use a script that performs a constant realtime search on the events your're interested in and sends them to the target system.

0 Karma

Path Finder

The problem with the syslog output is that it just dumps the raw event, no metadata. I need some of the metadata from the cooked event stream.

0 Karma