Splunk Search

UDP input and _TCP_ROUTING - is it possible?

andyk
Path Finder

Is it possible to use _TCP_ROUTING with a UDP input? I can not get it to work. My other "monitor" inputs works fine with _TCP_ROUTING. This is a full forwarder not a lwf.

inputs.conf:

[udp://514]
index = testapp
sourcetype = syslog
_TCP_ROUTING = pnlogGroup

outputs.conf:

[tcpout]
defaultGroup = SlogGroup
disabled = false
indexAndForward = 0

[tcpout:pnlogGroup]
disabled = false
server = 10.0.0.41:9997

[tcpout:SlogGroup]
disabled = false
server = 10.0.0.50:9995
Tags (2)
0 Karma
1 Solution

Masa
Splunk Employee
Splunk Employee

I think you already got answer a looooooong time ago. Answer is yes. A full Forwarder process data and parse events from udp inputs, and send the processed/parsed to Splunk as you configured in outputs.conf.

View solution in original post

kml_uvce
Builder

yes, here you are reciving data via udp but sending data via tcp and both are separated...
-Kamal Bisht

0 Karma

Masa
Splunk Employee
Splunk Employee

What do you mean by "sending data via tcp and both are separated.."?

0 Karma

Masa
Splunk Employee
Splunk Employee

I think you already got answer a looooooong time ago. Answer is yes. A full Forwarder process data and parse events from udp inputs, and send the processed/parsed to Splunk as you configured in outputs.conf.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...