README.md in fluent-plugin-splunkapi-0.1.5 vs README.md in fluent-plugin-splunkapi-0.2.0
- old
+ new
@@ -10,9 +10,58 @@
Splunk Storm API:
http://docs.splunk.com/Documentation/Storm/latest/User/UseStormsRESTAPI
+## Notes
+
+Although this plugin is capable of sending Fluent events directly to
+Splunk servers or Splunk Storm, it is not recommended to do so.
+Please use "Universal Forwarder" as a gateway, as described below.
+
+It is known that this plugin has several issues of performance and
+error handling in dealing with large data sets. With a local/reliable
+forwarder, you can aggregate a number of events locally and send them
+to a server in bulk.
+
+In short, I'd recommend to install a forwarder in each host, and use
+this plugin to deliver events to the local forwarder:
+
+ <match **>
+ # Deliver events to the local forwarder.
+ type splunkapi
+ protocol rest
+ server 127.0.0.1:8089
+ verify false
+ auth admin:changeme
+
+ # Convert fluent tags to Splunk sources.
+ # If you set an index, "check_index false" is required.
+ host YOUR-HOSTNAME
+ index SOME-INDEX
+ check_index false
+ source {TAG}
+ sourcetype fluent
+
+ # TIMESTAMP: key1="value1" key2="value2" ...
+ time_format unixtime
+ format kvp
+
+ # Memory buffer with a short flush internal.
+ buffer_type memory
+ buffer_queue_limit 16
+ buffer_chunk_limit 8m
+ flush_interval 2s
+ </match>
+
+## Additional Notes
+
+Splunk 5 has a new feature called "Modular Inputs":
+
+http://blogs.splunk.com/2013/04/16/modular-inputs-tools/
+
+My plan is switching to Modular Inputs rather than staying with APIs.
+
## Installation
Add this line to your application's Gemfile:
gem 'fluent-plugin-splunkapi'