Enable Ingest Processor in Splunk Cloud

Applicability

Description

Splunk's Ingest Processor is a data processing tool that can be used within a Splunk Cloud Platform deployment. It offers several benefits, primarily data flow configuration; Users can configure data flows, control data format, and apply transformation rules prior to indexing.

The Ingest Processor feature allows users to create and run pipelines into Splunk Cloud using Search Processing Language, version 2 (SPL2) at the time of data ingestion. SPL2 is a more concise language that supports both SPL and SQL syntax.

Investigation

Ingest Processor (formally named Data Processor) is only available on Victoria Experience for Splunk Cloud Platform. The minimum Splunk version is >= 9.1.2312.202.

• There are two tiers of Ingest Processor licenses: Essentials and Premier.
  
  
• The Ingest Processor Essentials Tier can be enabled for free with a Splunk Cloud Platform subscription, and accommodates a maximum Daily Processing Volume of 500 GB/day of incoming data.
  
  
• The Premier Tier is a paid subscription. For more information, contact your Sales representative.

Resolution

• Turning on the Ingest Processor feature flag requires creating a Support Case from the Support Portal under Support > Splunk Cloud > Cloud Change Request > Standard Configuration.
  
  
• In the Description field, enter the request to provision Ingest Processor Essentials Tier.
  
  
• Provide a Maintenance Window. For the best chance to accommodate you, preferably a standing maintenance window time frame, or at least several maintenance window options, including the Time Zone.

Related Links

Splunk Docs: About Ingest Processor