{"id":12746,"date":"2019-04-08T14:48:20","date_gmt":"2019-04-08T18:48:20","guid":{"rendered":"http:\/\/www.iri.com\/blog\/?p=12746"},"modified":"2025-06-09T12:15:47","modified_gmt":"2025-06-09T16:15:47","slug":"forward-voracity-data-into-splunk","status":"publish","type":"post","link":"https:\/\/www.iri.com\/blog\/business-intelligence\/forward-voracity-data-into-splunk\/","title":{"rendered":"Send Data from IRI Jobs &#038; Logs to Splunk Automatically"},"content":{"rendered":"<p class=\"c5\">Production or test data targets, as well as the operational log data, created by\u00a0<span class=\"c1\"><a class=\"c2\" href=\"https:\/\/www.iri.com\/products\/cosort\/sortcl\">SortCL<\/a><\/span>-compatible data manipulation or generation jobs in the\u00a0<span class=\"c1\"><a class=\"c2\" href=\"https:\/\/www.iri.com\/products\/voracity\">IRI Voracity<\/a><\/span> data management platform and its included tools (IRI CoSort, NextForm, RowGen, FieldShield) are all machine-readable. As such, that data can be forwarded automatically to Splunk for <a href=\"https:\/\/www.iri.com\/solutions\/business-intelligence\/bi-tool-acceleration\/splunk\">analytics<\/a>, <a href=\"https:\/\/www.iri.com\/blog\/data-protection\/darkshield-splunk-es\/\">dashboarding<\/a>, <a href=\"https:\/\/www.iri.com\/blog\/data-protection\/darkshield-alerts-from-splunk\/\">alerts<\/a>, etc. through\u00a0<span class=\"c1\"><a class=\"c2\" href=\"https:\/\/docs.splunk.com\/Documentation\/Forwarder\/7.2.5\/Forwarder\/Abouttheuniversalforwarder\">Splunk Universal Forwarder<\/a>\u00a0either ad hoc, scheduled, or in near real-time.\u00a0<\/span><span class=\"c4\">This article explains how to establish and test the connection. <\/span><\/p>\n<p class=\"c5\">In our sample use case, several CoSort data manipulation jobs will create target files that get written into a certain directory. We will configure Splunk Universal Forwarder to dynamically sense and\u00a0send all new or changed files in that folder into Splunk.<\/p>\n<p class=\"c5\">You might compare this method to the <a href=\"https:\/\/www.iri.com\/blog\/business-intelligence\/iri-masking-app-splunk\/\">Voracity Data Munging and Masking App for Splunk<\/a> or the older\u00a0<span class=\"c1\"><a class=\"c2\" href=\"https:\/\/www.iri.com\/blog\/data-transformation2\/iri-voracity-add-on-for-splunk\">Voracity add-on for Splunk<\/a><\/span>,<span class=\"c4\">\u00a0which both also effect seamless data flows into Splunk from the results of script-driven jobs like CoSort. The app \/ add-on method is more job-centric and less automatic; a new script must be specified and run for each joint operation to happen.<\/span><\/p>\n<p>At press time, the instructions consolidated below for our purposes were ultimately derived from the &#8216;Splunk Cloud User Manual&#8217; and these pages in particular:<\/p>\n<p><a href=\"https:\/\/docs.splunk.com\/Documentation\/SplunkCloud\/7.2.4\/User\/ForwardDataToSplunkCloudFromWindows\">docs.splunk.com\/Documentation\/SplunkCloud\/7.2.4\/User\/ForwardDataToSplunkCloudFromWindows<\/a><\/p>\n<p><span id=\"m_-3035432493670617551gmail-:2m.co\" class=\"m_-3035432493670617551gmail-tL8wMe m_-3035432493670617551gmail-EMoHub\" dir=\"ltr\"><a class=\"m_-3035432493670617551gmail-Xx\" href=\"https:\/\/www.google.com\/url?q=https:\/\/docs.splunk.com\/Documentation\/SplunkCloud\/7.2.4\/User\/ForwardDataToSplunkCloudFromLinux&amp;sa=D&amp;source=hangouts&amp;ust=1555438915698000&amp;usg=AFQjCNHfVBMKrU-JS6-tDj5WfaZVpvweUw\" target=\"_blank\" rel=\"nofollow noreferrer noopener\">docs.splunk.com\/Documentation\/SplunkCloud\/7.2.4\/User\/ForwardDataToSplunkCloudFromLinux<\/a>\u00a0<\/span><\/p>\n<p><span id=\"m_-3035432493670617551gmail-:2m.co\" class=\"m_-3035432493670617551gmail-tL8wMe m_-3035432493670617551gmail-EMoHub\" dir=\"ltr\"><a class=\"m_-3035432493670617551gmail-Xx\" href=\"https:\/\/www.google.com\/url?q=https:\/\/docs.splunk.com\/Documentation\/SplunkCloud\/7.2.4\/User\/ForwardDataToSplunkCloudFromOSX&amp;sa=D&amp;source=hangouts&amp;ust=1555438915698000&amp;usg=AFQjCNGBbE6wmgi0Je7gOj7tMbDrD_PAow\" target=\"_blank\" rel=\"nofollow noreferrer noopener\">docs.splunk.com\/Documentation\/SplunkCloud\/7.2.4\/User\/ForwardDataToSplunkCloudFromOSX<\/a>\u00a0<\/span><\/p>\n<div id=\"m_-3035432493670617551gmail-:2n.ma\" class=\"m_-3035432493670617551gmail-Mu m_-3035432493670617551gmail-SP\"><\/div>\n<p class=\"c5\">To set up Universal Forwarder, enter your Splunk instance and then click on\u00a0<span class=\"c21\">App: Universal Forwarder<\/span><span class=\"c4\">.<\/span><\/p>\n<p><a href=\"http:\/\/www.iri.com\/blog\/wp-content\/uploads\/2019\/04\/Splunk-UF.png\"><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-12751 aligncenter\" src=\"http:\/\/www.iri.com\/blog\/wp-content\/uploads\/2019\/04\/Splunk-UF-e1554746629820-1024x315.png\" alt=\"\" width=\"949\" height=\"292\" srcset=\"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2019\/04\/Splunk-UF-e1554746629820-1024x315.png 1024w, https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2019\/04\/Splunk-UF-e1554746629820-300x92.png 300w, https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2019\/04\/Splunk-UF-e1554746629820-768x236.png 768w, https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2019\/04\/Splunk-UF-e1554746629820.png 1600w\" sizes=\"(max-width: 949px) 100vw, 949px\" \/><\/a><\/p>\n<p class=\"c5\">Download the Splunk Universal Forwarder from the Splunk Downloads web page. This downloads as a msi file that you can run. Also download the\u00a0<span class=\"c8 c7\">customized universal forwarder credentials package.\u00a0<\/span><\/p>\n<p class=\"c5\"><span class=\"c7 c8\">The file downloaded should be similar to this:<\/span><\/p>\n<p><a href=\"\/blog\/wp-content\/uploads\/2019\/04\/Splunk-Forwarder-Download.png\"><img loading=\"lazy\" decoding=\"async\" class=\"size-full wp-image-12749 aligncenter\" src=\"\/blog\/wp-content\/uploads\/2019\/04\/Splunk-Forwarder-Download.png\" alt=\"\" width=\"419\" height=\"533\" srcset=\"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2019\/04\/Splunk-Forwarder-Download.png 419w, https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2019\/04\/Splunk-Forwarder-Download-236x300.png 236w\" sizes=\"(max-width: 419px) 100vw, 419px\" \/><\/a><\/p>\n<p class=\"c5\"><span class=\"c8 c7\">When the .msi file runs, a wizard walks you through installation. There are a few things to keep in mind, however.<\/span><\/p>\n<p class=\"c5\"><span class=\"c7\">In the first step, uncheck\u00a0<\/span><span class=\"c7 c17\"><em>Use this Universal Forwarder with on-premises Splunk Enterprise<\/em>\u00a0<\/span><span class=\"c8 c7\"><strong>if<\/strong> you are using Splunk Cloud. Be sure to click on custom setup to get more options, such as setting the sources from where data will be forwarded.<\/span><\/p>\n<p class=\"c5\"><span class=\"c7\">In the next step, enter your Splunk Cloud hostname in the\u00a0<\/span><span class=\"c7 c17\">Hostname or IP field<\/span><span class=\"c7\">. Replace\u00a0<\/span><em><span class=\"c7 c17\">https:\/\/<\/span><\/em><span class=\"c7\">\u00a0with\u00a0<\/span><em><span class=\"c7 c17\">input-<\/span><\/em><span class=\"c7\">. An example could be:\u00a0<\/span><em><span class=\"c11 c12\">input-prd-p-z41nh2qlt7cx.cloud.splunk.com<\/span><\/em><\/p>\n<p class=\"c5\"><span class=\"c4\">Enter 8089 as the port number (the default). The Splunk Universal Forwarder will install into your <em>Program Files<\/em> directory by default. Now, make sure the Splunk Universal Forwarder credentials have been downloaded from the App:Universal Forwarder page in Splunk.<\/span><\/p>\n<p class=\"c5\">In command line mode (<span class=\"c21\">Start<\/span>\u00a0<span class=\"c4\">cmd), enter this statement to install the credentials:<\/span><\/p>\n<pre class=\"c5\"><span class=\"c12 c11\">splunk install app <em>&lt;full path to splunkclouduf.spl&gt;<\/em><\/span><\/pre>\n<p class=\"c5\"><span class=\"c11\">replacing \u201c&lt;full path to splunkclouduf.spl&gt;\u201d with the actual full path. For this to work, you must first change directory to<br \/>\n<\/span><em><span class=\"c20\">C:\\Program Files\\SplunkUniversalForwarder\\bin&gt;\u00a0<\/span><\/em><span class=\"c9\">using the cd command.<\/span><\/p>\n<p class=\"c5\"><span class=\"c11\">Finally, run the command\u00a0<\/span><span class=\"c12 c11\"><em>splunk restart<\/em>.\u00a0<\/span><span class=\"c6\">Splunk should now recognize the forwarder.<\/span><\/p>\n<p class=\"c5\"><span class=\"c11\">To set up a source for data to be forwarded, go to\u00a0<\/span><em><span class=\"c21 c11\">Settings &gt; Add Data<\/span><\/em><span class=\"c11\">\u00a0in the top Splunk menu. This should lead to a screen something\u00a0<\/span><span class=\"c11\">like this<\/span><span class=\"c6\">\u00a0if the forwarder has been set up correctly.<\/span><\/p>\n<p><a href=\"http:\/\/www.iri.com\/blog\/wp-content\/uploads\/2019\/04\/Forward-Screen.png\"><img loading=\"lazy\" decoding=\"async\" class=\" wp-image-12754 aligncenter\" src=\"\/blog\/wp-content\/uploads\/2019\/04\/Forward-Screen-1024x491.png\" alt=\"\" width=\"954\" height=\"457\" srcset=\"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2019\/04\/Forward-Screen-1024x491.png 1024w, https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2019\/04\/Forward-Screen-300x144.png 300w, https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2019\/04\/Forward-Screen-768x368.png 768w, https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2019\/04\/Forward-Screen-1110x530.png 1110w, https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2019\/04\/Forward-Screen-730x350.png 730w, https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2019\/04\/Forward-Screen.png 1600w\" sizes=\"(max-width: 954px) 100vw, 954px\" \/><\/a><\/p>\n<p class=\"c5\"><span class=\"c11\">Select the host to forward from, then pick a Server Class Name that will help you identify what kind of files and data are being forwarded from the location you will select later.<\/span><\/p>\n<p class=\"c5\">In the next step, you can select a source to be monitored for data to be forwarded.\u00a0<span class=\"c3\">Data can be forwarded from a wide variety of sources, including local event logs, files and directories, TCP\/UDP ports, local performance, and data from any API, database, or service with a script.<\/span><\/p>\n<p><a href=\"http:\/\/www.iri.com\/blog\/wp-content\/uploads\/2019\/04\/Splunk-Universal-Forwarder-Sources.png\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter wp-image-12752 \" src=\"http:\/\/www.iri.com\/blog\/wp-content\/uploads\/2019\/04\/Splunk-Universal-Forwarder-Sources-e1554747513973-1024x573.png\" alt=\"\" width=\"946\" height=\"529\" srcset=\"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2019\/04\/Splunk-Universal-Forwarder-Sources-e1554747513973-1024x573.png 1024w, https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2019\/04\/Splunk-Universal-Forwarder-Sources-e1554747513973-300x168.png 300w, https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2019\/04\/Splunk-Universal-Forwarder-Sources-e1554747513973-768x430.png 768w, https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2019\/04\/Splunk-Universal-Forwarder-Sources-e1554747513973.png 1047w\" sizes=\"(max-width: 946px) 100vw, 946px\" \/><\/a><\/p>\n<p><span class=\"c13 c11\">In this case, we will be using\u00a0<\/span><span class=\"c3\">a directory that a CoSort SortCL programs will target for their output. Our raw input data sample is a file called employee.txt:<\/span><\/p>\n<p><a href=\"\/blog\/wp-content\/uploads\/2019\/04\/captureV2.png\"><img loading=\"lazy\" decoding=\"async\" class=\" wp-image-12764 aligncenter\" src=\"\/blog\/wp-content\/uploads\/2019\/04\/captureV2.png\" alt=\"\" width=\"950\" height=\"626\" srcset=\"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2019\/04\/captureV2.png 997w, https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2019\/04\/captureV2-300x198.png 300w, https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2019\/04\/captureV2-768x506.png 768w\" sizes=\"(max-width: 950px) 100vw, 950px\" \/><\/a><\/p>\n<p><span class=\"c13 c11\">I used the\u00a0<\/span><span class=\"c1 c13\"><a class=\"c2\" href=\"https:\/\/www.google.com\/url?q=https:\/\/www.iri.com\/products\/workbench&amp;sa=D&amp;ust=1554741242159000\">IRI Workbench<\/a><\/span><span class=\"c3\">\u00a0IDE\u2019s \u201cNew Sort Job \u2026\u201d wizard to automatically generate SortCL metadata and transformation parameters. The job shown below sorts the input file by Last Name, reformats it into CSV file, and writes that target into a folder I set up to be monitored by Splunk Universal Forwarder.<\/span><\/p>\n<p><a href=\"http:\/\/www.iri.com\/blog\/wp-content\/uploads\/2019\/04\/Splunk-UF-workbench.png\"><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-12756 aligncenter\" src=\"\/blog\/wp-content\/uploads\/2019\/04\/Splunk-UF-workbench-1024x572.png\" alt=\"\" width=\"938\" height=\"524\" srcset=\"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2019\/04\/Splunk-UF-workbench-1024x572.png 1024w, https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2019\/04\/Splunk-UF-workbench-300x167.png 300w, https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2019\/04\/Splunk-UF-workbench-768x429.png 768w, https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2019\/04\/Splunk-UF-workbench.png 1110w\" sizes=\"(max-width: 938px) 100vw, 938px\" \/><\/a><\/p>\n<p>Once the job runs, the file outputs very quickly into the folder and is automatically indexed into Splunk. Here is an image of that intermediate CSV file:<\/p>\n<p><a href=\"\/blog\/wp-content\/uploads\/2019\/04\/sort-LName-V2.png\"><img loading=\"lazy\" decoding=\"async\" class=\"size-full wp-image-12767 aligncenter\" src=\"\/blog\/wp-content\/uploads\/2019\/04\/sort-LName-V2.png\" alt=\"Sorted names\" width=\"738\" height=\"625\" srcset=\"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2019\/04\/sort-LName-V2.png 738w, https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2019\/04\/sort-LName-V2-300x254.png 300w\" sizes=\"(max-width: 738px) 100vw, 738px\" \/><\/a><\/p>\n<p>Back in Splunk, once your source is selected, it is possible to specify the input settings, or what kind of files you are expecting to be forwarded. This will help Splunk intelligently format the data while indexing it. In this step you can also select which index in Splunk will receive the data from the forwarder.<\/p>\n<p><a href=\"http:\/\/www.iri.com\/blog\/wp-content\/uploads\/2019\/04\/Splunk-UF-3rd-step-e1554746411752.png\"><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-12750 aligncenter\" src=\"http:\/\/www.iri.com\/blog\/wp-content\/uploads\/2019\/04\/Splunk-UF-3rd-step-e1554746411752-1024x629.png\" alt=\"Third step\" width=\"941\" height=\"578\" srcset=\"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2019\/04\/Splunk-UF-3rd-step-e1554746411752-1024x629.png 1024w, https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2019\/04\/Splunk-UF-3rd-step-e1554746411752-300x184.png 300w, https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2019\/04\/Splunk-UF-3rd-step-e1554746411752-768x472.png 768w, https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2019\/04\/Splunk-UF-3rd-step-e1554746411752.png 1224w\" sizes=\"(max-width: 941px) 100vw, 941px\" \/><\/a><\/p>\n<p>Back in Splunk, once your source is selected, it is possible to specify the input settings, or what kind of files you are expecting to be forwarded. This will help Splunk intelligently format the data while indexing it. In this step you can also select which index in Splunk will receive the data from the forwarder. Once indexed, the data will be available in Splunk:<\/p>\n<p><a href=\"http:\/\/www.iri.com\/blog\/wp-content\/uploads\/2019\/04\/employee-file.png\"><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-12757 aligncenter\" src=\"http:\/\/www.iri.com\/blog\/wp-content\/uploads\/2019\/04\/employee-file-e1554746351445-1024x504.png\" alt=\"Employee file\" width=\"941\" height=\"463\" srcset=\"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2019\/04\/employee-file-e1554746351445-1024x504.png 1024w, https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2019\/04\/employee-file-e1554746351445-300x148.png 300w, https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2019\/04\/employee-file-e1554746351445-768x378.png 768w, https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2019\/04\/employee-file-e1554746351445.png 1110w\" sizes=\"(max-width: 941px) 100vw, 941px\" \/><\/a><\/p>\n<p>Of course, once the data is indexed in Splunk, visualizations are possible. Here are a couple of them that I created for a dashboard based on the employee data from the file I indexed to Splunk:<\/p>\n<p><a href=\"http:\/\/www.iri.com\/blog\/wp-content\/uploads\/2019\/04\/splunk-results.png\"><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-12755 aligncenter\" src=\"http:\/\/www.iri.com\/blog\/wp-content\/uploads\/2019\/04\/splunk-results-e1554746300587-1024x489.png\" alt=\"Splunk results\" width=\"938\" height=\"448\" srcset=\"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2019\/04\/splunk-results-e1554746300587-1024x489.png 1024w, https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2019\/04\/splunk-results-e1554746300587-300x143.png 300w, https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2019\/04\/splunk-results-e1554746300587-768x367.png 768w, https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2019\/04\/splunk-results-e1554746300587-1110x530.png 1110w, https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2019\/04\/splunk-results-e1554746300587-730x350.png 730w, https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2019\/04\/splunk-results-e1554746300587.png 1600w\" sizes=\"(max-width: 938px) 100vw, 938px\" \/><\/a><\/p>\n<p><span id=\"m_-3035432493670617551gmail-:2n.co\" class=\"m_-3035432493670617551gmail-tL8wMe m_-3035432493670617551gmail-EMoHub\" dir=\"ltr\">If you have other IRI jobs or logs to forward to Splunk, just add another forwarder source. For each source, navigate to &#8220;add data&#8221; in the Splunk interface, choose forwarder, select your forwarder, then specify where the data will come from and, optionally, the file type (which Splunk may also detect). You can add as many forwarding sources as need to.<\/span><\/p>\n<p>Bottom line: The Splunk Universal Forwarder allows for easy integration with IRI Voracity or its subset products to combine the functionality and benefits of both vendor platforms seamlessly.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Production or test data targets, as well as the operational log data, created by\u00a0SortCL-compatible data manipulation or generation jobs in the\u00a0IRI Voracity data management platform and its included tools (IRI CoSort, NextForm, RowGen, FieldShield) are all machine-readable. As such, that data can be forwarded automatically to Splunk for analytics, dashboarding, alerts, etc. through\u00a0Splunk Universal Forwarder\u00a0either<\/p>\n<div><a class=\"btn-filled btn\" href=\"https:\/\/www.iri.com\/blog\/business-intelligence\/forward-voracity-data-into-splunk\/\" title=\"Send Data from IRI Jobs &#038; Logs to Splunk Automatically\">Read More<\/a><\/div>\n","protected":false},"author":119,"featured_media":12757,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"_exactmetrics_skip_tracking":false,"_exactmetrics_sitenote_active":false,"_exactmetrics_sitenote_note":"","_exactmetrics_sitenote_category":0,"footnotes":""},"categories":[108,32,8,776,91],"tags":[52,44,2142,2143,968,2141,100,850,68,574,1403,379],"class_list":["post-12746","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-big-data-2","category-business-intelligence","category-data-protection","category-etl","category-iri-workbench","tag-business-intelligence-2","tag-cosort","tag-data-integration-targets","tag-data-integration-tool-logs","tag-data-management-platform","tag-data-masking-logs","tag-etl","tag-iri-workbench","tag-sortcl","tag-splunk","tag-splunk-universal-forwarder","tag-test-data-management"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v23.4 (Yoast SEO v23.4) - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Send Data from IRI Jobs &amp; Logs to Splunk Automatically - IRI<\/title>\n<meta name=\"description\" content=\"Forward data targets and logs from data processing jobs in Voracity or ither IRI tools to Splunk indexes through\u00a0Splunk Universal Forwarder.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.iri.com\/blog\/business-intelligence\/forward-voracity-data-into-splunk\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Send Data from IRI Jobs &amp; Logs to Splunk Automatically\" \/>\n<meta property=\"og:description\" content=\"Forward data targets and logs from data processing jobs in Voracity or ither IRI tools to Splunk indexes through\u00a0Splunk Universal Forwarder.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.iri.com\/blog\/business-intelligence\/forward-voracity-data-into-splunk\/\" \/>\n<meta property=\"og:site_name\" content=\"IRI\" \/>\n<meta property=\"article:published_time\" content=\"2019-04-08T18:48:20+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2025-06-09T16:15:47+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2019\/04\/employee-file-e1554746351445.png\" \/>\n\t<meta property=\"og:image:width\" content=\"1110\" \/>\n\t<meta property=\"og:image:height\" content=\"546\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"Devon Kozenieski\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Devon Kozenieski\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"7 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.iri.com\/blog\/business-intelligence\/forward-voracity-data-into-splunk\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.iri.com\/blog\/business-intelligence\/forward-voracity-data-into-splunk\/\"},\"author\":{\"name\":\"Devon Kozenieski\",\"@id\":\"https:\/\/www.iri.com\/blog\/#\/schema\/person\/de972c035aaeecfc40a3ae2ea5ff7ba1\"},\"headline\":\"Send Data from IRI Jobs &#038; Logs to Splunk Automatically\",\"datePublished\":\"2019-04-08T18:48:20+00:00\",\"dateModified\":\"2025-06-09T16:15:47+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.iri.com\/blog\/business-intelligence\/forward-voracity-data-into-splunk\/\"},\"wordCount\":954,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/www.iri.com\/blog\/#organization\"},\"image\":{\"@id\":\"https:\/\/www.iri.com\/blog\/business-intelligence\/forward-voracity-data-into-splunk\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2019\/04\/employee-file-e1554746351445.png\",\"keywords\":[\"business intelligence\",\"CoSort\",\"data integration targets\",\"data integration tool logs\",\"data management platform\",\"data masking logs\",\"ETL\",\"IRI Workbench\",\"SortCL\",\"Splunk\",\"Splunk Universal Forwarder\",\"test data management\"],\"articleSection\":[\"Big Data\",\"Business Intelligence (BI&#041;\",\"Data Masking\/Protection\",\"ETL\",\"IRI Workbench\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/www.iri.com\/blog\/business-intelligence\/forward-voracity-data-into-splunk\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.iri.com\/blog\/business-intelligence\/forward-voracity-data-into-splunk\/\",\"url\":\"https:\/\/www.iri.com\/blog\/business-intelligence\/forward-voracity-data-into-splunk\/\",\"name\":\"Send Data from IRI Jobs & Logs to Splunk Automatically - IRI\",\"isPartOf\":{\"@id\":\"https:\/\/www.iri.com\/blog\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/www.iri.com\/blog\/business-intelligence\/forward-voracity-data-into-splunk\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/www.iri.com\/blog\/business-intelligence\/forward-voracity-data-into-splunk\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2019\/04\/employee-file-e1554746351445.png\",\"datePublished\":\"2019-04-08T18:48:20+00:00\",\"dateModified\":\"2025-06-09T16:15:47+00:00\",\"description\":\"Forward data targets and logs from data processing jobs in Voracity or ither IRI tools to Splunk indexes through\u00a0Splunk Universal Forwarder.\",\"breadcrumb\":{\"@id\":\"https:\/\/www.iri.com\/blog\/business-intelligence\/forward-voracity-data-into-splunk\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.iri.com\/blog\/business-intelligence\/forward-voracity-data-into-splunk\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.iri.com\/blog\/business-intelligence\/forward-voracity-data-into-splunk\/#primaryimage\",\"url\":\"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2019\/04\/employee-file-e1554746351445.png\",\"contentUrl\":\"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2019\/04\/employee-file-e1554746351445.png\",\"width\":1110,\"height\":546,\"caption\":\"Employee file\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.iri.com\/blog\/business-intelligence\/forward-voracity-data-into-splunk\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/www.iri.com\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Send Data from IRI Jobs &#038; Logs to Splunk Automatically\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.iri.com\/blog\/#website\",\"url\":\"https:\/\/www.iri.com\/blog\/\",\"name\":\"IRI\",\"description\":\"Total Data Management Blog\",\"publisher\":{\"@id\":\"https:\/\/www.iri.com\/blog\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.iri.com\/blog\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.iri.com\/blog\/#organization\",\"name\":\"IRI\",\"url\":\"https:\/\/www.iri.com\/blog\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.iri.com\/blog\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2019\/02\/iri-logo-total-data-management-small-1.png\",\"contentUrl\":\"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2019\/02\/iri-logo-total-data-management-small-1.png\",\"width\":750,\"height\":206,\"caption\":\"IRI\"},\"image\":{\"@id\":\"https:\/\/www.iri.com\/blog\/#\/schema\/logo\/image\/\"}},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.iri.com\/blog\/#\/schema\/person\/de972c035aaeecfc40a3ae2ea5ff7ba1\",\"name\":\"Devon Kozenieski\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.iri.com\/blog\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/e4c421588c1a85dd9a76146fe15528f7?s=96&d=blank&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/e4c421588c1a85dd9a76146fe15528f7?s=96&d=blank&r=g\",\"caption\":\"Devon Kozenieski\"},\"url\":\"https:\/\/www.iri.com\/blog\/author\/devonk\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Send Data from IRI Jobs & Logs to Splunk Automatically - IRI","description":"Forward data targets and logs from data processing jobs in Voracity or ither IRI tools to Splunk indexes through\u00a0Splunk Universal Forwarder.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.iri.com\/blog\/business-intelligence\/forward-voracity-data-into-splunk\/","og_locale":"en_US","og_type":"article","og_title":"Send Data from IRI Jobs & Logs to Splunk Automatically","og_description":"Forward data targets and logs from data processing jobs in Voracity or ither IRI tools to Splunk indexes through\u00a0Splunk Universal Forwarder.","og_url":"https:\/\/www.iri.com\/blog\/business-intelligence\/forward-voracity-data-into-splunk\/","og_site_name":"IRI","article_published_time":"2019-04-08T18:48:20+00:00","article_modified_time":"2025-06-09T16:15:47+00:00","og_image":[{"width":1110,"height":546,"url":"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2019\/04\/employee-file-e1554746351445.png","type":"image\/png"}],"author":"Devon Kozenieski","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Devon Kozenieski","Est. reading time":"7 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.iri.com\/blog\/business-intelligence\/forward-voracity-data-into-splunk\/#article","isPartOf":{"@id":"https:\/\/www.iri.com\/blog\/business-intelligence\/forward-voracity-data-into-splunk\/"},"author":{"name":"Devon Kozenieski","@id":"https:\/\/www.iri.com\/blog\/#\/schema\/person\/de972c035aaeecfc40a3ae2ea5ff7ba1"},"headline":"Send Data from IRI Jobs &#038; Logs to Splunk Automatically","datePublished":"2019-04-08T18:48:20+00:00","dateModified":"2025-06-09T16:15:47+00:00","mainEntityOfPage":{"@id":"https:\/\/www.iri.com\/blog\/business-intelligence\/forward-voracity-data-into-splunk\/"},"wordCount":954,"commentCount":0,"publisher":{"@id":"https:\/\/www.iri.com\/blog\/#organization"},"image":{"@id":"https:\/\/www.iri.com\/blog\/business-intelligence\/forward-voracity-data-into-splunk\/#primaryimage"},"thumbnailUrl":"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2019\/04\/employee-file-e1554746351445.png","keywords":["business intelligence","CoSort","data integration targets","data integration tool logs","data management platform","data masking logs","ETL","IRI Workbench","SortCL","Splunk","Splunk Universal Forwarder","test data management"],"articleSection":["Big Data","Business Intelligence (BI&#041;","Data Masking\/Protection","ETL","IRI Workbench"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.iri.com\/blog\/business-intelligence\/forward-voracity-data-into-splunk\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.iri.com\/blog\/business-intelligence\/forward-voracity-data-into-splunk\/","url":"https:\/\/www.iri.com\/blog\/business-intelligence\/forward-voracity-data-into-splunk\/","name":"Send Data from IRI Jobs & Logs to Splunk Automatically - IRI","isPartOf":{"@id":"https:\/\/www.iri.com\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.iri.com\/blog\/business-intelligence\/forward-voracity-data-into-splunk\/#primaryimage"},"image":{"@id":"https:\/\/www.iri.com\/blog\/business-intelligence\/forward-voracity-data-into-splunk\/#primaryimage"},"thumbnailUrl":"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2019\/04\/employee-file-e1554746351445.png","datePublished":"2019-04-08T18:48:20+00:00","dateModified":"2025-06-09T16:15:47+00:00","description":"Forward data targets and logs from data processing jobs in Voracity or ither IRI tools to Splunk indexes through\u00a0Splunk Universal Forwarder.","breadcrumb":{"@id":"https:\/\/www.iri.com\/blog\/business-intelligence\/forward-voracity-data-into-splunk\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.iri.com\/blog\/business-intelligence\/forward-voracity-data-into-splunk\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.iri.com\/blog\/business-intelligence\/forward-voracity-data-into-splunk\/#primaryimage","url":"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2019\/04\/employee-file-e1554746351445.png","contentUrl":"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2019\/04\/employee-file-e1554746351445.png","width":1110,"height":546,"caption":"Employee file"},{"@type":"BreadcrumbList","@id":"https:\/\/www.iri.com\/blog\/business-intelligence\/forward-voracity-data-into-splunk\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.iri.com\/blog\/"},{"@type":"ListItem","position":2,"name":"Send Data from IRI Jobs &#038; Logs to Splunk Automatically"}]},{"@type":"WebSite","@id":"https:\/\/www.iri.com\/blog\/#website","url":"https:\/\/www.iri.com\/blog\/","name":"IRI","description":"Total Data Management Blog","publisher":{"@id":"https:\/\/www.iri.com\/blog\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.iri.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.iri.com\/blog\/#organization","name":"IRI","url":"https:\/\/www.iri.com\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.iri.com\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2019\/02\/iri-logo-total-data-management-small-1.png","contentUrl":"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2019\/02\/iri-logo-total-data-management-small-1.png","width":750,"height":206,"caption":"IRI"},"image":{"@id":"https:\/\/www.iri.com\/blog\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/www.iri.com\/blog\/#\/schema\/person\/de972c035aaeecfc40a3ae2ea5ff7ba1","name":"Devon Kozenieski","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.iri.com\/blog\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/e4c421588c1a85dd9a76146fe15528f7?s=96&d=blank&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/e4c421588c1a85dd9a76146fe15528f7?s=96&d=blank&r=g","caption":"Devon Kozenieski"},"url":"https:\/\/www.iri.com\/blog\/author\/devonk\/"}]}},"jetpack_featured_media_url":"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2019\/04\/employee-file-e1554746351445.png","_links":{"self":[{"href":"https:\/\/www.iri.com\/blog\/wp-json\/wp\/v2\/posts\/12746"}],"collection":[{"href":"https:\/\/www.iri.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.iri.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.iri.com\/blog\/wp-json\/wp\/v2\/users\/119"}],"replies":[{"embeddable":true,"href":"https:\/\/www.iri.com\/blog\/wp-json\/wp\/v2\/comments?post=12746"}],"version-history":[{"count":22,"href":"https:\/\/www.iri.com\/blog\/wp-json\/wp\/v2\/posts\/12746\/revisions"}],"predecessor-version":[{"id":18439,"href":"https:\/\/www.iri.com\/blog\/wp-json\/wp\/v2\/posts\/12746\/revisions\/18439"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.iri.com\/blog\/wp-json\/wp\/v2\/media\/12757"}],"wp:attachment":[{"href":"https:\/\/www.iri.com\/blog\/wp-json\/wp\/v2\/media?parent=12746"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.iri.com\/blog\/wp-json\/wp\/v2\/categories?post=12746"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.iri.com\/blog\/wp-json\/wp\/v2\/tags?post=12746"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}