Forward Data

[shangshin]

Hi,
I am trying to forward raw data to a none-splunk system by adding an entry at Manager » Forwarding and receiving » Forward data e.g. 10.50.1.1:1111
I also set the option "Yes" in store a local copy of forwarded events.

However, after restarting the splunk server, I don't see any new events get indexed on the splunk UI. On top of, I saw the message "skipped indexing of internal audit event will keep dropping events until indexer congestion is remedied."

Once I deleted the entry in "Forward data", everything is back to normal.
Please note this splunk server is receiving 200 events per second from splunk_universal_forwarder.

Please shed some light on this. Thanks in advance!!!

Error in splunk/var/log/splunk/splunkd.log

11-16-2012 16:38:25.282 -0500 ERROR splunklogger - Uncaught exception in pipeline execution (tcp-output-generic-processor) - getting next event

11-16-2012 16:38:25.283 -0500 ERROR pipeline - Runtime exception in pipeline: indexerPipe, processor: tcp-output-generic-processor, error: vector::_M_range_check

[sbrant_splunk]

This would be a valid method if you were attempting to forward data to a Splunk indexer. However, since you are sending to a 3rd-party system, this will not work. Since your forwarding system does not recognize the receiving system as Splunk, forwarding will not take place. This document explains how you should configure forwarding to a non-Splunk system:

http://docs.splunk.com/Documentation/Splunk/5.0/Deploy/Forwarddatatothird-partysystemsd

[bmacias84]

Keep in mind that UF or LF types do not have the ability to route and filter data by events. A HF is required. Splunk and only send raw events to a third party system.