Deployment Architecture

Splunk integration with third party systems

asp12
New Member

Hi All,

To forward data to third-party systems, integrated  splunk agent with below configs. 

Third party is able to receive data by listening on TCP port.

Issue: Unable to view default internal fields like source or host required for data enrichment. 

              Tried adding host and source in inputs.conf, but no luck.

Is there any limitation for forwarding internal fields to third party systems?

inputs.conf

[blacklist:$SPLUNK_HOME/var/log/splunk]

[monitor:///tmp/test1.log]

_TCP_ROUTING = App1Group

 

outputs.conf

[tcpout:App1Group]

server=<ip address>:<port>

sendCookedData = false

Labels (1)
0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!