Deployment Architecture

Splunk integration with third party systems

asp12
New Member

Hi All,

To forward data to third-party systems, integrated  splunk agent with below configs. 

Third party is able to receive data by listening on TCP port.

Issue: Unable to view default internal fields like source or host required for data enrichment. 

              Tried adding host and source in inputs.conf, but no luck.

Is there any limitation for forwarding internal fields to third party systems?

inputs.conf

[blacklist:$SPLUNK_HOME/var/log/splunk]

[monitor:///tmp/test1.log]

_TCP_ROUTING = App1Group

 

outputs.conf

[tcpout:App1Group]

server=<ip address>:<port>

sendCookedData = false

Labels (1)
0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!