Getting Data In

using forwarder and scripts together

ajitshukla
Explorer

We have binary data in .dat file and we have converted it to csv format by running scripts on forwarder and have send csv data to splunk instance. But now the requirement is that we should not run scripts on forwarder.
IS there any way to send binary data to splunk through forwarder and then use scripts ( on splunk side)to parse it to csv format ????

0 Karma

somesoni2
Revered Legend
0 Karma

lakshman239
Influencer

Splunk (indexer) can process binay file, if you don't want to pre-process in forwarder. But, generally pre-processing and sending ascii/text is the preferred way.

Can you load the binary file on to a splunk dev instance [ via Data inputs] and see if it can parse and extract fields? If it does and matches your requirement, you can use the generated props.conf and use it in your instance. Also look at the following https://www.splunk.com/blog/2011/07/19/the-naughty-bits-how-to-splunk-binary-logfiles.html

0 Karma
Get Updates on the Splunk Community!

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Index This | What goes away as soon as you talk about it?

May 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...