Splunk Writer
Overview
You can use this Snap to write data to a specific Splunk index.
- Write-type Snap
- Works in Ultra Pipelines
Prerequisites
None.
Limitations and known issues
None.
Snap views
View | Description | Examples of upstream and downstream Snaps |
---|---|---|
Input | It must contain one or more binary data objects. | |
Output | A document with {"status": "success"} if the upload is successful. |
|
Error |
Error handling is a generic way to handle errors without losing data or failing the Snap execution. You can handle the errors that the Snap might encounter when running the pipeline by choosing one of the following options from the When errors occur list under the Views tab. The available options are:
Learn more about Error handling in Pipelines. |
Snap settings
- Suggestion icon (): Indicates a list that is dynamically populated based on the configuration.
- Expression icon (): Indicates whether the value is an expression (if enabled) or a static value (if disabled). Learn more about Using Expressions in SnapLogic.
- Add icon (): Indicates that you can add fields in the field set.
- Remove icon (): Indicates that you can remove fields from the field set.
Field / Field set | Type | Description |
---|---|---|
Label | String |
Required. Specify a unique name for the Snap. Modify this to be more appropriate, especially if more than one of the same Snaps is in the pipeline. Default value: Splunk Writer Example: Employees list |
Splunk index | String/Expression |
Required. A repository for data in Splunk Enterprise. When Splunk Enterprise indexes raw event data, it transforms the data into searchable events. You may select one from the suggested list. If the "=" button is pressed, it can be an expression evaluated with pipeline parameters. Default value: N/A Example:
|
Host | String/Expression |
Specify the host argument of the event. For more information refer to Splexicon: Host, and host. Default value: N/A Example: myapp-server-01 |
Host regex | String/Expression |
Specify the host_regex argument of the event. For more information refer to host_regex. Default value: N/A Example: "your_regular_expression" |
Source | String/Expression |
Specify the source field for the incoming data, indicating the origin or location of the log events being sent to Splunk. For more information refer to Splexicon: Source. Default value: N/A Example: my_application_logs |
Source type | String/Expression |
Specify the sourcetype field for the incoming data, indicating the format or category of the log events being sent to Splunk. For more information refer to Source type and Splexicon: Source type. Default value: N/A Example: apache:access |
Snap execution | Dropdown list | Select one of the three modes in which the Snap executes.
Available options are:
|