Splunk Dev

Forward Data

shangshin
Builder

Hi,
I am trying to forward raw data to a none-splunk system by adding an entry at Manager » Forwarding and receiving » Forward data e.g. 10.50.1.1:1111
I also set the option "Yes" in store a local copy of forwarded events.

However, after restarting the splunk server, I don't see any new events get indexed on the splunk UI. On top of, I saw the message "skipped indexing of internal audit event will keep dropping events until indexer congestion is remedied."

Once I deleted the entry in "Forward data", everything is back to normal.
Please note this splunk server is receiving 200 events per second from splunk_universal_forwarder.

Please shed some light on this. Thanks in advance!!!

Error in splunk/var/log/splunk/splunkd.log

11-16-2012 16:38:25.282 -0500 ERROR splunklogger - Uncaught exception in pipeline execution (tcp-output-generic-processor) - getting next event

11-16-2012 16:38:25.283 -0500 ERROR pipeline - Runtime exception in pipeline: indexerPipe, processor: tcp-output-generic-processor, error: vector::_M_range_check

Tags (2)
0 Karma

sbrant_splunk
Splunk Employee
Splunk Employee

This would be a valid method if you were attempting to forward data to a Splunk indexer. However, since you are sending to a 3rd-party system, this will not work. Since your forwarding system does not recognize the receiving system as Splunk, forwarding will not take place. This document explains how you should configure forwarding to a non-Splunk system:

http://docs.splunk.com/Documentation/Splunk/5.0/Deploy/Forwarddatatothird-partysystemsd

bmacias84
Champion

Keep in mind that UF or LF types do not have the ability to route and filter data by events. A HF is required. Splunk and only send raw events to a third party system.

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...