Splunk® Data Stream Processor

Connect to Data Sources and Destinations with DSP

On April 3, 2023, Splunk Data Stream Processor reached its end of sale, and will reach its end of life on February 28, 2025. If you are an existing DSP customer, please reach out to your account team for more information.

All DSP releases prior to DSP 1.4.0 use Gravity, a Kubernetes orchestrator, which has been announced end-of-life. We have replaced Gravity with an alternative component in DSP 1.4.0. Therefore, we will no longer provide support for versions of DSP prior to DSP 1.4.0 after July 1, 2023. We advise all of our customers to upgrade to DSP 1.4.0 in order to continue to receive full product support from Splunk.

Connecting syslog data sources to your DSP pipeline

When creating a data pipeline in the , you can get syslog data into your pipeline by routing the data to a Splunk Connect for Syslog (SC4S) instance and then connecting to the SC4S instance as a data source. You can get syslog data into a pipeline, transform the data as needed, and then send the transformed data out from the pipeline to a destination of your choosing.

See Splunk Connect for Syslog for more information about SC4S.

To connect to SC4S as a data source, you must complete the following tasks:

  1. Configure your SC4S instance to send syslog data to DSP. You'll need to generate a DSP HTTP Event Collector (HEC) token and configure your SC4S instance to use it. See Configure SC4S to send syslog data to DSP.
  2. Create a pipeline that starts with the Splunk DSP Firehose source function.

When you activate the pipeline, the source function starts collecting the syslog data that is being routed to the SC4S instance.

Last modified on 25 March, 2022
Set the default field values in DSP HEC   Configure SC4S to send syslog data to DSP

This documentation applies to the following versions of Splunk® Data Stream Processor: 1.2.0, 1.2.1-patch02, 1.2.1, 1.2.2-patch02, 1.2.4, 1.2.5, 1.3.0, 1.3.1, 1.4.0, 1.4.1, 1.4.2, 1.4.3, 1.4.4, 1.4.5


Was this topic useful?







You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters