UDP input and _TCP_ROUTING - is it possible?

[andyk]

Is it possible to use _TCP_ROUTING with a UDP input? I can not get it to work. My other "monitor" inputs works fine with _TCP_ROUTING. This is a full forwarder not a lwf.

inputs.conf:

[udp://514]
index = testapp
sourcetype = syslog
_TCP_ROUTING = pnlogGroup

outputs.conf:

[tcpout]
defaultGroup = SlogGroup
disabled = false
indexAndForward = 0

[tcpout:pnlogGroup]
disabled = false
server = 10.0.0.41:9997

[tcpout:SlogGroup]
disabled = false
server = 10.0.0.50:9995

[kml_uvce]

yes, here you are reciving data via udp but sending data via tcp and both are separated...
-Kamal Bisht

[Masa]

What do you mean by "sending data via tcp and both are separated.."?

[Masa · Accepted solution]

I think you already got answer a looooooong time ago. Answer is yes. A full Forwarder process data and parse events from udp inputs, and send the processed/parsed to Splunk as you configured in outputs.conf.