Splunk® Data Stream Processor

Connect to Data Sources and Destinations with DSP

Acrobat logo Download manual as PDF

Acrobat logo Download topic as PDF

Connecting a Splunk forwarder to your DSP pipeline

When creating a data pipeline in the , you can connect to a Splunk heavy forwarder or universal forwarder and use it as a data source. You can get data from a forwarder into a pipeline, transform the data as needed, and then send the transformed data out from the pipeline to a destination of your choosing.

To connect to a forwarder as a data source, you must complete the following tasks:

  1. Create a self-signed SSL certificate, and upload it to the Forwarders service. Then, configure your heavy forwarder or universal forwarder to trust the client certificate. See Create a connection between a Splunk forwarder and the Forwarders service.
  2. If your DSP account has the user role instead of the admin role, you'll need your DSP administrator to grant you permissions to use the Forwarders service. See Allow DSP users to use the Forwarders service.
  3. Create a pipeline that starts with the Forwarders Service source function.
  4. If you are using a universal forwarder as a data source, process the data to make sure that events are not being truncated or grouped unexpectedly. See Process data from a universal forwarder in DSP.

When you activate the pipeline, the source function starts collecting the data that is being forwarded by the Splunk forwarder.

How forwarded data is collected

A forwarder is a Splunk Enterprise instance that sends data to another Splunk Enterprise instance, such as an indexer or another forwarder, or to a third-party system. In this case, the forwarder sends data to the Forwarders service that runs within the , and your data pipeline ingests that data from the Forwarders service. The Forwarders service identifies incoming connections from forwarders by the client certificate on the forwarder.

The following diagram shows how data is streamed from a Splunk forwarder into DSP and then sent out to a destination. This diagram shows how data starts from a data source, goes into a Splunk forwarder, and then enters DSP. From there, you can apply other functions to your forwarders data before sending that data off to a Splunk index or to a third-party destination.

The data from the Forwarders service has the following schema:

Field Description
body Contains the payload of the event. The default data type of the body field is a union of all possible types. To pass body as an argument to a downstream function that requires a specific type, you must first cast body to that specific type.

See data types in the Use the manual for more information about union data types. See cast or ucast in the Function Reference manual for examples of how to cast union data to a specific type.

attributes Contains metadata fields about your forwarder.
host Contains information about the host for your forwarder.
source Contains information about the source for your forwarder.
source_type Contains information about the source_type for your forwarder.
timestamp Contains the timestamp of your event. When receiving data from a heavy forwarder, DSP uses the timestamp determined and extracted by the heavy forwarder. When receiving data from a universal forwarder, which does not do any processing of your events, DSP sets the timestamp to the time when the event was ingested.
nanos Contains nanoseconds beyond the timestamp.
id Contains a unique ID of the event. If it is not specified, the system generates an ID.
Last modified on 03 May, 2021
Managing connections in the
Create a connection between a Splunk forwarder and the Forwarders service

This documentation applies to the following versions of Splunk® Data Stream Processor: 1.2.0, 1.2.1

Was this documentation topic helpful?

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters