Getting Data In

Filter Unparsed Cooked Data

ephemeric
Contributor

Hello all,

I have tested with cooked, unparsed, encrypted data from a Universal Forwarder and filtering works.

The indexer input is however splunktcp-ssl and it works.

As per docs:

[tcp-ssl:]
Use this stanza type if you are receiving encrypted, unparsed data from a forwarder or third-party system.
Set to the port on which the forwarder/third-party system is sending unparsed, encrypted data.

This input broke event filtering.

Can I just go ahead and use splunktcp-ssl and assume all is good?

Thank you.

0 Karma

Ayn
Legend

You should use splunktcp type connections for receiving data from Universal Forwarders. tcp-ssl is as is implied in the docs mostly for 3rd party products. There's no need to use it unless you know what you're doing and why.

0 Karma

Ayn
Legend

UF doesn't do parsing so that shouldn't be a problem.

ephemeric
Contributor

We did use it in the past to do event filtering which wouldn't work for parsed data from a LF.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...