Splunk® Data Stream Processor

Connect to Data Sources and Destinations with DSP

Acrobat logo Download manual as PDF

On October 30, 2022, all 1.2.x versions of the Splunk Data Stream Processor will reach its end of support date. See the Splunk Software Support Policy for details. For information about upgrading to a supported version, see the Upgrade the Splunk Data Stream Processor topic.
This documentation does not apply to the most recent version of Splunk® Data Stream Processor. For documentation on the most recent version, go to the latest release.
Acrobat logo Download topic as PDF

Configure SC4S to send syslog data to DSP

To get syslog data from Splunk Connect for Syslog (SC4S) into a data pipeline in the , you must configure your SC4S instance to send the data to DSP. You can then use the Splunk DSP Firehose source function to get this syslog data into a DSP pipeline.


Before you can use SC4S as a data source, you must have a DSP HTTP Event Collector (HEC) token for allowing SC4S to send data to DSP. See Create and manage DSP HEC tokens through the Splunk Cloud Services CLI for more information. You'll need the <token> value that gets returned when the token is created.

Make sure that the SC4S disk buffer configuration is correctly set up to minimize the number of lost events if the connection to DSP is temporarily unavailable. See Data Resilience - Local Disk Buffer Configuration and SC4S Disk Buffer Configuration for more information on SC4S disk buffering.


  1. To configure your SC4S instance to use your DSP HEC token, set the following environment variables:
  2. Restart your SC4S workflow.

SC4S starts sending syslog data to DSP. You can now use SC4S as a data source by creating a pipeline that starts with the Splunk DSP Firehose source function. For instructions on how to build a data pipeline, see the Building a pipeline chapter in the Use the Data Stream Processor manual. For information about the source function, see Get data from Splunk DSP Firehose in the Function Reference manual.

Last modified on 13 January, 2023
Connecting syslog data sources to your DSP pipeline
Connecting multiple data sources to your DSP pipeline

This documentation applies to the following versions of Splunk® Data Stream Processor: 1.2.0, 1.2.1-patch02, 1.2.1, 1.2.2-patch02, 1.2.4, 1.2.5, 1.3.0, 1.3.1

Was this documentation topic helpful?

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters