topic Re: Seeking Solutions for Forwarding Splunk Metadata to Third-Party Systems Over TCP/HTTP in Splunk Enterprise

Seeking Solutions for Forwarding Splunk Metadata to Third-Party Systems Over TCP/HTTP

sudha_krish — Mon, 12 May 2025 05:20:12 GMT

I want to forward logs to a third-party system over HTTP, but I found in the Splunk documentation that forwarding logs to third-party systems is typically done over TCP. I tried using TCP, but I did not receive Splunk metadata like host, sourcetype, source, and index on the third-party system.

Is it possible to forward logs with metadata to a third-party system over HTTP? If not, how can I get Splunk metadata over TCP? Can anyone suggest a solution?

@splunk @splunkent2 @Splunk9 @msplunk @splunk0

Re: Seeking Solutions for Forwarding Splunk Metadata to Third-Party Systems Over TCP/HTTP

kiran_panchavat — Mon, 12 May 2025 06:15:29 GMT

@sudha_krish

Splunk forwarders (Universal or Heavy) send only raw event data to non-Splunk systems over TCP or syslog by default, as outlined in the Splunk documentation. Metadata such as host, sourcetype, source, and index is internal to Splunk and not included in the raw event payload.

To forward logs with metadata over HTTP reliably, tools like Cribl Stream are commonly used. These tools can intercept Splunk data, enrich it with metadata, and send it to third-party systems via HTTP.

Cribl (https://cribl.io/) allows you to route events to multiple systems but maintain full metadata. In addition, you can be very selective about what goes where and you can reshape and enrich events as they're moving.

Re: Seeking Solutions for Forwarding Splunk Metadata to Third-Party Systems Over TCP/HTTP

livehybrid — Mon, 12 May 2025 06:22:10 GMT

Hi @sudha_krish

Sending out over HTTP does not use an open HTTP standard/API - it uses Splunk2Splunk protocol wrapped in HTTP, so therefore it is only supported for sending to other Splunk systems.

If you want to send data to a non-Splunk system you can look at the syslog forwarding, however this sends the raw events before they are parsed.

For more information on sending to external systems please check out https://docs.splunk.com/Documentation/SplunkCloud/latest/Forwarding/Forwarddatatothird-partysystemsd

🌟 Did this answer help you? If so, please consider:

Adding karma to show it was useful
Marking it as the solution if it resolved your issue
Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

Re: Seeking Solutions for Forwarding Splunk Metadata to Third-Party Systems Over TCP/HTTP

PickleRick — Mon, 12 May 2025 06:24:03 GMT

See my response in your other thread.