Getting Data In

Splunk forwarder not receiving events immediately

formanojr
New Member

Hi,
We are using a Splunk forwarder to forward events to Splunk indexer/Server. This is what we are doing:
1. Create a socket connection to Splunk forwarder. Connect to the socket. Write to the socket through a stream and close the socket. Next time create a new socket to connect to the forwarder.
2. The above way pushes the events and shows up immediately on the Splunk side.

Since creating and destroying is not useful, we tried implementing a socket pool to maintain the connection in the pool and reuse it.

What we observed with this is that the events written to the socket from the pool (to the forwarder) doesn't show up in the Splunk server immediately. We are not even sure if would show up eventually.
* Is there some buffering configuration on the forwarder side ?
* Also is there a standard SDK/api types (TCPInput seems like for indexers on the server side) that could used to push events to the forwarder ?

Thanks!

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Concerning your last bit, you're probably looking for this: http://docs.splunk.com/Documentation/Splunk/6.1.1/RESTAPI/RESTinput#receivers.2Fstream

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...