using forwarder and scripts together

[ajitshukla]

We have binary data in .dat file and we have converted it to csv format by running scripts on forwarder and have send csv data to splunk instance. But now the requirement is that we should not run scripts on forwarder.
IS there any way to send binary data to splunk through forwarder and then use scripts ( on splunk side)to parse it to csv format ????

[somesoni2]

Have a look at this:
https://www.splunk.com/blog/2011/07/19/the-naughty-bits-how-to-splunk-binary-logfiles.html

[lakshman239]

Splunk (indexer) can process binay file, if you don't want to pre-process in forwarder. But, generally pre-processing and sending ascii/text is the preferred way.

Can you load the binary file on to a splunk dev instance [ via Data inputs] and see if it can parse and extract fields? If it does and matches your requirement, you can use the generated props.conf and use it in your instance. Also look at the following https://www.splunk.com/blog/2011/07/19/the-naughty-bits-how-to-splunk-binary-logfiles.html