Getting Data In

Forwarding logs to a third party system using a universal forwarder with sendCookedData = false, can we see the set sourcetype at the receiving end?

immortalraghava
Path Finder

Hi All,

We are sending logs to a third party system.
And in the inputs.conf monitor stanza, we have set:

sendCookedData = false
sourcetype = errorlogs
index = logs_index

sendCookedData = false because we are forwarding logs to a third party system.. (Mentioned in doc)

Also, we have set the sourcetype and specified an index..

Can we read the sourcetype set for the data at the receiving end?
For now we are able to see only the plain loglines.

Appreciate any help!
Thanks

1 Solution

jkat54
SplunkTrust
SplunkTrust

No. cooked data would include the sourcetype and destination index so if you disable sending cooked data you won't get those details.

View solution in original post

jkat54
SplunkTrust
SplunkTrust

No. cooked data would include the sourcetype and destination index so if you disable sending cooked data you won't get those details.

immortalraghava
Path Finder

Hey thanks for your answer. But cooked data looks like its encoded on the receiving side. Is there a way to decode / retrieve sourcetype from cooked data in a third party receiver ?

0 Karma

jkat54
SplunkTrust
SplunkTrust

Nope, as it is mentioned Splunk cooked data is proprietary.

esix_splunk
Splunk Employee
Splunk Employee

Cooked data is a Splunk proprietary format, for Splunk to Splunk communication.

If you are sending to a 3rd party, I dont understand why you need an index our sourcetype, these are Specific to Splunk. What are you trying to integrate the feed with? Have you checked this:

http://docs.splunk.com/Documentation/Splunk/6.4.1/Forwarding/Forwarddatatothird-partysystemsd

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...