We have updated our Terms of Service, Code of Conduct, and Addendum.

Is there any workaround to send uncooked data from Splunk HF to Cribl?

Options
Perry Correll
Perry Correll Posts: 3 mod
in General Discussions

Hey, Is there any workaround to send uncooked data from Splunk HF to Cribl? (dest::Splunktcp) The issue is that the EB(Cribl) is not taking any effect (I'd read before it will be skipped by design limitations). tried to set sendCookedData = false but the data flow had stopped eventually, then added negotiateProtocolLevel = 0 but it didn't help, other trial was to use dest::tcp source but ingestion has stopped as well. Any ideas how we can overcome this scenario.

Answers

  • xpac xpac
    xpac xpac Posts: 148 ✭✭✭
    Options

    Cribl can totally process data that has already been processed by a HF before

  • xpac xpac
    xpac xpac Posts: 148 ✭✭✭
    Options

    The other way wouldn't work (without ugly hacks)

  • Perry Correll
    Perry Correll Posts: 3 mod
    Options

    Then how can it re-process them although it skips the EB in Cribl source

  • xpac xpac
    xpac xpac Posts: 148 ✭✭✭
    Options

    Oh, that's supposed to mean event breaker

  • xpac xpac
    xpac xpac Posts: 148 ✭✭✭
    Options

    So, what issue do you have? Are your events improperly broken on the HF, and how?

  • xpac xpac
    xpac xpac Posts: 148 ✭✭✭
    Options

    Is one event containing multiple events? That could be fixed. Is one event only containing parts of one event? That's something that can't really be fixed later

  • Perry Correll
    Perry Correll Posts: 3 mod
    Options

    The latter unfortunately, thats why I'm not using the event breaker function in the pipeline

  • xpac xpac
    xpac xpac Posts: 148 ✭✭✭
    Options

    Yeah, that's something you need to fix on the HF (or bypass it ")

Categories