topic Re: Forward specific data from one Splunk instance to another Splunk instance in Splunk Cloud Platform

Forward specific data from one Splunk instance to another Splunk instance

RSS_STT — Thu, 24 Apr 2025 07:40:49 GMT

I have two separate Splunk cloud instance and want to forward specific set of data from one instance to another. Please suggest the approach or any app/add-on available for this purpose.

Re: Forward specific data from one Splunk instance to another Splunk instance

livehybrid — Thu, 24 Apr 2025 07:50:38 GMT

Hi @RSS_STT

It isnt possible to use typical data forwarding from Splunk Cloud to another system.

The only Splunkbase apps I have seen for things like sending to HEC or external systems generally arent supported for Splunk Cloud, therefore the only other option would be to run something that uses the Search API to search the data and send it to the appropriate place.

Ultimately this is a very bad idea and not something that is supported or encouraged.

What is your ultimate goal? Is there a reason you arent able to forward the data from source to multiple destinations, or use federated search to query the data from Splunk Cloud from your other instance?

The only other route I can think of is using Ingest Actions to send the data to S3 and then using the AWS TA to ingest this using your other Splunk instance.

🌟 Did this answer help you? If so, please consider:

Adding karma to show it was useful
Marking it as the solution if it resolved your issue
Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

Re: Forward specific data from one Splunk instance to another Splunk instance

isoutamo — Thu, 24 Apr 2025 09:30:16 GMT

It's like @livehybrid said. You cannot / shouldn't try this that way.

Basically there are two options to do this depending how your data is collected and where it's created.

In SCP side you can set Federated Search in your SCP and use it to access data from another SCP stack. See more https://docs.splunk.com/Documentation/SplunkCloud/9.3.2411/FederatedSearch/fsoptions.

The second option is replicate data before you send it into SCP stack. E.g. you could set your own HFs where you can set this.

r. Ismo