Splunk Search

Splunk data format

wildbill4
Path Finder

What is the Splunk data format of data being forwarded? Splunk website states TCP is format for transmission but its really a protocol for transmission?

Tags (2)
1 Solution

dwaddle
SplunkTrust
SplunkTrust

The "over the wire" format for Splunk's communications between forwarders and indexers does use TCP as its transport. The "Splunk protocol" inside TCP is Splunk proprietary and (to my knowledge) not documented.

If you are planning to build a receiver for Splunk forwarder data, be aware that Splunk can forward over a plain TCP socket to a 3rd party system. See http://www.splunk.com/base/Documentation/latest/Admin/Forwarddatatothird-partysystems

View solution in original post

dwaddle
SplunkTrust
SplunkTrust

The "over the wire" format for Splunk's communications between forwarders and indexers does use TCP as its transport. The "Splunk protocol" inside TCP is Splunk proprietary and (to my knowledge) not documented.

If you are planning to build a receiver for Splunk forwarder data, be aware that Splunk can forward over a plain TCP socket to a 3rd party system. See http://www.splunk.com/base/Documentation/latest/Admin/Forwarddatatothird-partysystems

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...