Splunk Output0

The Splunk Output transformation step enables you to connect to a Splunk server and write events to a Splunk index. By default, the step writes events as name value pairs separated by newline characters, but can also write arbitrary formats by customizing event data. You must have write access to a Splunk server before you use the Splunk Output step. To learn more about Splunk see their online documentation.

Option	Definition
Step name	Name of the step as it appears in the transformation workspace.
Host name(s) or IP address(es)	Specifies the network name or address of the Splunk instance or instances.
Port	Indicates the port number of the Splunk (splunkd) server. The default value is 8089, but your administrator may have changed the port number.
Username	Specifies the username required to access the Splunk server.
Password	Indicates the password associated with the Username.
Index to write to	Specifies the Splunk index where the events are stored. Usually, this is the main index. Check your Splunk server for a list of available indices. This field can be parameterized with incoming fields (?{<Field>}) or transformation parameters (${Parameter}).
Event host	Indicates the hostname of the original event host. If you want to gather data from a router and write it to Splunk, use the router's host name. This field can be parameterized with incoming fields (?{<Field>}) or transformation parameters (${Parameter}).
Event source type	Indicates the format type of the event data. The list of known source types appears here. To define a new format, follow these instructions.
Event source	Indicates the source of the event data. See Splunk documentationfor more details.
Customize Splunk event	If checked, enables the Splunk Event Data option and allows you to customize the data coming into Splunk. This is useful if you want to write a different format than the default, which is name value pairs separated by newline characters.
Splunk event data	Allows you to specify customized event text. This field can be parameterized with incoming fields (?{<Field>}) or transformation parameters (${Parameter}).