matjahs/rumc-splunk-to-data-input.md

Created October 25, 2023 13:53

Star (0) You must be signed in to star a gist
Fork (0) You must be signed in to fork a gist

Learn more about clone URLs
Clone this repository at <script src="https://gist.github.com/matjahs/bdfc27c3cfca317599fa962a13cc7422.js"></script>
Save matjahs/bdfc27c3cfca317599fa962a13cc7422 to your computer and use it in GitHub Desktop.

Splunk TO - Data Input

Raw

sequenceDiagram
    F5->>F5: Event
    F5->>SC4S: Forward (UDP)
    SC4S->>SC4S: Parse
    SC4S->>SC4S: Add metadata
    SC4S->>Indexer: Forward (HTTP)
    Indexer->>Indexer: Index