PutSplunk

Description:

Sends logs to Splunk Enterprise over TCP, TCP + TLS/SSL, or UDP. If a Message Delimiter is provided, then this processor will read messages from the incoming FlowFile based on the delimiter, and send each message to Splunk. If a Message Delimiter is not provided then the content of the FlowFile will be sent directly to Splunk as if it were a single message.

Tags:

splunk, logs, tcp, udp

Properties:

In the list below, the names of required properties appear in bold. Any other properties (not in bold) are considered optional. The table also indicates any default values, and whether a property supports the NiFi Expression Language.

NameDefault ValueAllowable ValuesDescription
HostnamelocalhostThe ip address or hostname of the destination.
Supports Expression Language: true (will be evaluated using variable registry only)
PortThe port on the destination.
Supports Expression Language: true (will be evaluated using variable registry only)
Max Size of Socket Send Buffer1 MBThe maximum size of the socket send buffer that should be used. This is a suggestion to the Operating System to indicate how big the socket buffer should be. If this value is set too low, the buffer may fill up before the data can be read, and incoming data will be dropped.
Idle Connection Expiration5 secondsThe amount of time a connection should be held open without being used before closing the connection.
Timeout10 secondsThe timeout for connecting to and communicating with the destination. Does not apply to UDP
Character SetUTF-8Specifies the character set of the data being sent.
ProtocolTCP
  • TCP
  • UDP
The protocol for communication.
Message DelimiterSpecifies the delimiter to use for splitting apart multiple messages within a single FlowFile. If not specified, the entire content of the FlowFile will be used as a single message. If specified, the contents of the FlowFile will be split on this delimiter and each section sent as a separate message. Note that if messages are delimited and some messages for a given FlowFile are transferred successfully while others are not, the messages will be split into individual FlowFiles, such that those messages that were successfully sent are routed to the 'success' relationship while other messages are sent to the 'failure' relationship.
Supports Expression Language: true (will be evaluated using flow file attributes and variable registry)
SSL Context ServiceController Service API:
SSLContextService
Implementations: StandardRestrictedSSLContextService
StandardSSLContextService
The Controller Service to use in order to obtain an SSL Context. If this property is set, messages will be sent over a secure connection.

Relationships:

NameDescription
successFlowFiles that are sent successfully to the destination are sent out this relationship.
failureFlowFiles that failed to send to the destination are sent out this relationship.

Reads Attributes:

None specified.

Writes Attributes:

None specified.

State management:

This component does not store state.

Restricted:

This component is not restricted.

Input requirement:

This component requires an incoming relationship.

System Resource Considerations:

None specified.