Get data from Forwarders service

Use the Forwarders Service source function to get data from a Splunk universal or heavy forwarder. This is a source function that filters your data to only ingest data from the Splunk Forwarders Service. See also Process data from a universal forwarder.

Function output schema

This function outputs data pipeline events using the event schema for events or metrics schema for metrics.

Required arguments

connection_id

Syntax: string

Description: The ID of your Splunk Forwarders connection. Must be set to "forwarders:all".

Example: "forwarders:all"

SPL2 example

When working in the SPL View, you can write the function using the following syntax.

| from forwarders("forwarders:all") |....;

Alternatively, you can use the named argument syntax to write this function.

| from forwarders(connection_id: "forwarders:all") |....;

Limitations of the Forwarders Service

The maximum supported size for a record is 5MB. If any records exceed that size, the Forwarders service returns an error.