Forwarding logs to Splunk

You can run Transaction Analysis Workbench batch jobs that stream log data in JSON Lines format to a TCP data input on a remote Splunk indexer.

Figure that shows Transaction Analysis Workbench converting a log to JSON Lines format, and then streaming the JSON Lines over a network to a Splunk TCP data input on a remote system. — Figure 1. Forwarding logs to Splunk: streaming JSON Lines over TCP

Basic Splunk configuration for streaming JSON Lines over TCP
To stream JSON Lines to Splunk over TCP, you need to configure a Splunk TCP data input that breaks each line of the stream into a separate event, recognizes event time stamps, and specifies the event data format as JSON.
Splunk source types
Rather than assigning the same source type to all events from Transaction Analysis Workbench, you might prefer more granularity; more source types. Here are some methods for assigning different source types to events.
Splunk indexes
Rather than storing all events from Transaction Analysis Workbench in the same Splunk index, you might prefer to use multiple indexes. Here are some methods for controlling which indexes events are stored in.
Splunk secure TCP
You can configure Transaction Analysis Workbench and Splunk to use Transport Layer Security (TLS) over TCP.

Parent topic: Forwarding logs to analytics platforms

Related tasks

Streaming logs as JSON Lines over TCP to an analytics platform