Route Universal Forwarder data directly to Machine Data Lake

Configure a Universal Forwarder monitored input so matching events land in a Machine Data Lake raw table.

  • You have a Machine Data Lake raw table and know its resource name, such as ~.federated.<raw_table_name>.

  • The Universal Forwarder already uses the existing Splunk Cloud receiver and TLS credentials in outputs.conf.

  • You can update the app that manages the monitored input and restart the forwarder.

Use this route when you can change the Universal Forwarder input configuration. The inputs.conf stanza selects the raw table destination. The existing outputs.conf configuration continues to send data to the Splunk Cloud receiver with the existing TLS credentials. There is no Machine Data Lake-specific outputs.conf stanza.

  1. Open the app that manages the monitored input on the Universal Forwarder.

    Put the input override in the app's local/inputs.conf file. For example, use $SPLUNK_HOME/etc/apps/<app_name>/local/inputs.conf.

  2. Add or update the monitored input so the index target is the Machine Data Lake raw table resource name.
    CODE 
    [monitor:///var/log/cisco/asa.log]
disabled = false
sourcetype = cisco:asa
index = ~.federated.<raw_table_name>
  3. Save the file and restart the Universal Forwarder.
    CODE 
    $SPLUNK_HOME/bin/splunk restart
  4. Generate a uniquely identifiable test event in the monitored file.

    For example, write one line that includes mdl_test_id=<unique_id> and a recognizable action value to /var/log/cisco/asa.log.

  5. Verify the test event in the raw table.

    Open the raw table from the Catalog and search for the unique test value by using a narrow time range.

    CODE 
    mdl_test_id="<unique_id>" sourcetype="cisco:asa" source="/var/log/cisco/asa.log"

The Universal Forwarder sends the monitored events through the existing Splunk Cloud output connection, and Splunk Cloud Platform routes events with index = ~.federated.<raw_table_name> to the Machine Data Lake raw table.

For more information, see Configure the universal forwarder using configuration files and Configure forwarding with outputs.conf.