Splunk Cloud Platform

Use Edge Processors

Acrobat logo Download manual as PDF


Acrobat logo Download topic as PDF

Apply pipelines to Edge Processors

An Edge Processor acts on the data that it receives based on the data processing instructions defined in the associated pipelines. Apply pipelines to your Edge Processor as needed to specify how you want it to process and route your data.

Prerequisites

Before you can apply a pipeline to an Edge Processor, you must have an Edge Processor that has the Healthy status. See Set up an Edge Processor for information about setting up Edge Processors.

Apply a pipeline to one or more Edge Processors

You can apply a pipeline to multiple Edge Processors at the same time.

  1. Navigate to the Pipelines page.
  2. In the row that lists the pipeline you want to apply, select the Actions icon (Image of the Actions icon) and then select Apply/remove.
  3. Select the Edge Processors that you want to apply the pipeline to, and then select Save.
  4. It can take a few minutes for the Edge Processor service to finish applying your pipeline to an Edge Processor. During this time, all Edge Processors that the pipeline is applied to enter the Pending status. To confirm that the process completed successfully, do the following:

    • Navigate to the Edge Processors page. Then, verify that the Instance health column for the affected Edge Processors shows that all instances are back in the Healthy status.
    • Navigate to the Pipelines page. Then, verify that the Applied column for the pipeline contains a The pipeline is applied icon (Image of the "applied pipeline" icon).

    You might need to refresh your browser to see the latest updates.

The Edge Processors that you applied the pipeline to can now process and route data according to the instructions specified in the pipeline.

If you apply and remove the same pipeline from the same Edge Processor in quick succession, then the status icons might present conflicting information until one of the processes is completed.

Apply one or more pipelines to an Edge Processor

You can apply multiple pipelines at once to the same Edge Processor.

  1. Do one of the following:
    • On the Edge Processors page, in the row that lists the Edge Processor you want to apply pipelines to, select the Actions icon (Image of the Actions icon) and then select Apply/remove pipelines.
    • On the detailed view for a specific Edge Processor, select Actions > Apply/remove pipelines.
  2. Select the pipelines that you want to apply to the Edge Processor, and then select Save.

It can take a few minutes for the Edge Processor service to finish applying your pipeline to an Edge Processor. During this time, all Edge Processors that the pipeline is applied to enter the Pending status. To confirm that the process completed successfully, do the following:

  • Navigate to the Edge Processors page. Then, verify that the Instance health column for the affected Edge Processors shows that all instances are back in the Healthy status.
  • Navigate to the Pipelines page. Then, verify that the Applied column for the pipeline contains a The pipeline is applied icon (Image of the "applied pipeline" icon).

You might need to refresh your browser to see the latest updates.


The Edge Processor that you applied the pipelines to can now process and route data according to the instructions specified in the pipelines.

If you apply and remove the same pipeline from the same Edge Processor in quick succession, then the status icons might present conflicting information until one of the processes is completed.

Last modified on 23 August, 2023
PREVIOUS
Extract timestamps from event data using an Edge Processor
  NEXT
Remove pipelines from Edge Processors

This documentation applies to the following versions of Splunk Cloud Platform: 9.0.2209, 9.0.2303, 9.0.2305, 9.1.2308 (latest FedRAMP release), 9.1.2312


Was this documentation topic helpful?


You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters