Splunk® Data Stream Processor

Connect to Data Sources and Destinations with DSP

Acrobat logo Download manual as PDF


DSP 1.2.0 is impacted by the CVE-2021-44228 and CVE-2021-45046 security vulnerabilities from Apache Log4j. To fix these vulnerabilities, you must upgrade to DSP 1.2.4. See Upgrade the Splunk Data Stream Processor to 1.2.4 for upgrade instructions.

On October 30, 2022, all 1.2.x versions of the Splunk Data Stream Processor will reach its end of support date. See the Splunk Software Support Policy for details.
This documentation does not apply to the most recent version of Splunk® Data Stream Processor. For documentation on the most recent version, go to the latest release.
Acrobat logo Download topic as PDF

Create a DSP connection to a Splunk index

To send data from a data pipeline in the to a Splunk index, you must first create a connection using the Connector for the Splunk Platform. You can then use the connection in the Send to a Splunk Index with Batching or Send to a Splunk Index sink functions to send data from your DSP pipeline to your Splunk index.

Prerequisites

Steps

  1. From the Data Stream Processor home page, click Data Management and then select the Connections tab.
  2. Click Create new connection.
  3. Select Connector for the Splunk Platform and then click Next.
  4. Complete the following fields:
    Field Description
    Connection Name A unique name for your connection.
    Description (Optional) A description of your connection.
    Splunk HEC endpoint URLs Your HEC endpoint URLs, separated by commas. Load balancing is performed if more than one endpoint is provided.


    The HEC endpoint URL format varies depending on whether you are sending data to Splunk Enterprise or Splunk Cloud Platform.

    • If you are connecting to Splunk Enterprise, then the HEC URLs must be formatted as https://hostname:port, https://hostname:port.
    • If you are connecting to a paid Splunk Cloud Platform, then the HEC URLs must be formatted as https://http-inputs-<host1>.splunkcloud.com:443, https://http-inputs-<host2>.splunkcloud.com:443. By default, the paid version of Splunk Cloud Platform uses port number 443 to listen for connections.
    • If you are connecting to a trial version of Splunk Cloud Platform, then the HEC URLs must be formatted as https://inputs.<host>.splunkcloud.com:8088. By default, the trial version of Splunk Cloud Platform uses port number 8088 to listen for connections.
    Splunk HEC endpoint token HEC token for the Splunk Enterprise or Splunk Cloud Platform instance.

    Any credentials that you upload are transmitted securely by HTTPS, encrypted, and securely stored in a secrets manager.

  5. Click Save.
  6. If you're editing a connection that's being used by an active pipeline, you must reactivate that pipeline after making your changes. When you reactivate a pipeline, you must select where you want to resume data ingestion. See Using activation checkpoints to activate your pipeline in the Use the Data Stream Processor manual for more information.

You can now use your connection to send data to an index in Splunk Enterprise or Splunk Cloud Platform using the HTTP Event Collector. For detailed instructions on how to send data to Splunk Enterprise or Splunk Cloud Platform, see Connecting Splunk indexes to your DSP pipeline.

Last modified on 26 February, 2022
PREVIOUS
Connecting your DSP pipeline to a Splunk index
  NEXT
Format event data in DSP for Splunk indexes

This documentation applies to the following versions of Splunk® Data Stream Processor: 1.2.0, 1.2.1-patch02, 1.2.1, 1.2.2-patch02, 1.2.4, 1.2.5


Was this documentation topic helpful?


You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters