Getting Data In

Could I send uncooked data to a splunk indexer?

sonicant
Path Finder

In the document I found:
With raw data, ...... This is particularly useful for sending data to a non-Splunk system.

In my case, the server which forwarder was installed has heavy load, and all the log files are zipped.
So the forwarder has to decompress the packages then read the log files and send data to indexer, this consumes extra CPU time, and leads to slow data forwarding.

So I wonder is there a way to tell the forwarder don't decompress the ZIP packages, just send them to indexer and let indexers do the unzip job?

I tried adding "sendCookedData=false" to inputs.conf and restarted the forwarder, but then the indexer refused the connection from the forwarder....

Thanks for anyone may help!

Tags (1)
0 Karma
1 Solution

Ayn
Legend

No, regardless of whether the data would be cooked or not, you can't send data from zip files straight away like that. That data is cooked just means (somewhat simplified) that certain metadata is added to the data stream instead of just sending the raw data. It doesn't affect how the events are read from the sources initially.

View solution in original post

Ayn
Legend

No, regardless of whether the data would be cooked or not, you can't send data from zip files straight away like that. That data is cooked just means (somewhat simplified) that certain metadata is added to the data stream instead of just sending the raw data. It doesn't affect how the events are read from the sources initially.

Ayn
Legend

That is correct.

0 Karma

sonicant
Path Finder

Hi Ayn

Thank you! So there is no way to let forwarder send original zip files to indexer. (Unless using self-made scripts to do the file transferring) Is my understanding right?
And the sendCookedData=false option should only be used when sending data to non-Splunk listener, right?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...