Getting Data In

To use or not to use TCP as input method?

samiomer
Path Finder

Hi all,

I have a few custom remote sensors that I would like Splunk to monitor. These sensors do not use files or TCP to log (they use other forms like web services and other distributed messaging systems).

So, my question is, what would make the most sense in converting these logs? Should I write them to disk and have splunk monitor them as files or should I transport them via TCP and have Splunk monitor the port? When Splunk monitors a TCP port, does it write the data coming in to the file system before processing it? Because if so, it wouldn't make a difference (performance-wise) to convert my custom logs to files or stream through TCP, correct?

Thanks in advance.

Tags (2)
0 Karma
1 Solution

araitz
Splunk Employee
Splunk Employee

Have your application write to an appended log file, and have a Splunk universal forwarder take care of the monitoring and transport layer. The framework team has done a lot of work to get the forwarder where it is today, so why not take advantage of it? 🙂

View solution in original post

0 Karma

araitz
Splunk Employee
Splunk Employee

Have your application write to an appended log file, and have a Splunk universal forwarder take care of the monitoring and transport layer. The framework team has done a lot of work to get the forwarder where it is today, so why not take advantage of it? 🙂

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...