Splunk Cloud Platform

Use Ingest Processors

Ingest Processor is currently released as a preview only and is not officially supported. See Splunk General Terms for more information. For any questions on this preview, please reach out to ingestprocessor@splunk.com. Complete the preview application on the Voice of the Customer portal to get access to a demo for a tenant.

About Ingest Processor

Ingest Processor is a data processing capability that works within your Splunk Cloud Platform deployment. Use the Ingest Processor to configure data flows, control data format, apply transformation rules prior to indexing, and route to destinations.

The Ingest Processor solution is suitable for Splunk Cloud Platform administrators who use forwarders or HTTP Event Collector (HEC) to get data into their deployments.

You can easily deploy and use Ingest Processor since it does not require any additional infrastructure in your Splunk Cloud Platform environment. Ingest Processor will seamlessly scale and adjust your infrastructure resources according to your organization's needs. The Ingest Processor solution also lets you manage your data processing configurations and monitor your data ingest traffic through a centralized Splunk Cloud service.

What is the difference between Ingest Processor and Edge Processor?

See the following table to review the differences between Ingest Processor and Edge Processor.

Features Edge Processor Ingest Processor
Solution description Edge Processor is a Splunk product that allows you to process data using SPL2 before you send that data out of your network to external destinations. You use a Splunk-managed cloud service to deploy and manage on-premises Edge Processors at the edge of your network. Ingest Processor is a Splunk Cloud Platform capability that allows you to process data using SPL2 at the time of data ingestion.
Supported data sources
  • Forwarders
  • HTTP clients and logging applications through the HTTP Event Collector (HEC)
  • Syslog devices
All data sources supported by Splunk Cloud Platform deployments on Victoria Experience.
Where processing takes place At the edge of your network, close to the data source. In Splunk Cloud Platform.
Generate logs into metrics No Yes
Enrich data using lookups Yes No
Routing to Splunk Enterprise indexes Yes No
Routing to Splunk Observability Cloud No Yes
Data format when routing to Amazon S3 JSON files that use the Splunk HEC schema
  • Parquet files
  • JSON files that use the Splunk HEC schema

For information about the Edge Processor solution, see the Use Edge Processors manual.

Ingest Processor components

The following diagram provides an overview of the components that comprise the Ingest Processor service, and whether each component is hosted in the Splunk Cloud Platform environment or your local environment. See the System architecture section on this page for more information.

This diagram shows how the Ingest Processor service in your Splunk Cloud Platform environment works. Data is generated by a source, collected by agents such as forwarders, sent to the Ingest Processor service for processing, and then routed to a destination.

Get started with the Ingest Processor solution

Before you can start using the Ingest Processor solution, you must gain access to a cloud tenant where the Ingest Processor is available. Complete the preview application on the Voice of the Customer portal to get access to a demo for a tenant. No additional cloud computing resources (AWS, Azure, GCP) are needed in order to run Ingest Processor.

To learn more about how the Ingest Processor solution works and become more familiar with key terms and concepts, see How the Ingest Processor solution works. For information about the types of data processing operations that are supported, see Ingest Processor pipeline syntax.


See the following documentation for more information about the Ingest Processor solution and other Splunk software that works in conjunction with the Ingest Processor solution. For this information, see the following:

For this information Refer to this documentation
Regional availability of the Ingest Processor solution Cloud region:
  • us-east-1
  • us-west-2
  • ap-southeast-2
  • eu-central-1
  • eu-west-1
Complete information about the supported SPL2 commands and functions.
How to configure Splunk forwarders The Forwarding Data manual
Last modified on 12 June, 2024
  How the Ingest Processor solution works

This documentation applies to the following versions of Splunk Cloud Platform: 9.1.2308 (latest FedRAMP release), 9.1.2312, 9.2.2403

Was this topic useful?

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters