Hi all,
I have a few custom remote sensors that I would like Splunk to monitor. These sensors do not use files or TCP to log (they use other forms like web services and other distributed messaging systems).
So, my question is, what would make the most sense in converting these logs? Should I write them to disk and have splunk monitor them as files or should I transport them via TCP and have Splunk monitor the port? When Splunk monitors a TCP port, does it write the data coming in to the file system before processing it? Because if so, it wouldn't make a difference (performance-wise) to convert my custom logs to files or stream through TCP, correct?
Thanks in advance.
... View more