splunk_hec not showing its listening on port

[rajsinghtech]

    api:
      enabled: true
      address: 127.0.0.1:8687
      playground: true

    data_dir: ./data_dir

    # LOG DATAPLANE port 6000
    # METRICS DATAPLANE port 6001
    sources:
      # datadog_agent:
      #   address: 0.0.0.0:8282
      #   type: datadog_agent
      # fluent:
      #   address: 0.0.0.0:24224
      #   type: fluent
      # internal_metrics:
      #   type: internal_metrics
      # logstash:
      #   address: 0.0.0.0:5044
      #   type: logstash
      splunk_hec:
        address: 0.0.0.0:8088
        type: splunk_hec
      # statsd:
      #   address: 0.0.0.0:8125
      #   mode: tcp
      #   type: statsd
      # syslog:
      #   address: 0.0.0.0:9000
      #   mode: tcp
      #   type: syslog
      # vector:
      #   address: 0.0.0.0:6000
      #   type: vector
    sinks:
      splunk:
        type: console
        inputs:
          - splunk_hec
        encoding:
          codec: json

[jszwedko]

Hi @rajsinghtech ,

I don't think the Splunk source logs that "listening on port" output like the API does. It certainly could though. We'd be happy to see a PR adding it, I think.

[rajsinghtech]

Do people normally use the httpout or the tcp out to do the forwarding to vector?

[rajsinghtech]

The problem with this method is you end up loosing alot of the metadata the the forwarder brings with the logs.

[rajsinghtech]

So just to confirm Splunk Forwarder doesn't support splunk_hec. And the workaround is to use socket as a source and set the forwarder to point to the socket "at some path" and set sendCookedData=false?

[jszwedko]

Yeah, you do unfortunately lose the metadata 😞 Unfortunately, Splunk's "cooked" Splunk2Splunk (S2S) protocol that forwards the metadata is considered proprietary by them and is undocumented. Vector's support for it is being tracked by #3848 but I don't have high hopes.

[jszwedko]

Correct, my understanding is that Splunk forwarders don't actually support forwarding data using the HEC protocol.