topic Re: forwarding to third party REST endpoint in Deployment Architecture

forwarding to third party REST endpoint

vijay — Sun, 27 Jun 2021 14:53:53 GMT

Hi,

Is it possible from Splunk universal/heavy forwarder to forward data to third party REST API endpoint over https using basic authentication ?

I have use case where Splunk universal/heavy forwarder has to forward data to Splunk enterprise + 3rd party client REST api endpoint for processing data.

Is this use case possible ?

Re: forwarding to third party REST endpoint

venkatasri — Mon, 28 Jun 2021 00:25:21 GMT

Hi @vijay

Splunk docs suggest HF can forward to only TCP endpoint not to HTTP Rest API. You can find same documentation here - Forward data to third-party systems - Splunk Documentation

If you wish to do so i would do using store-and-forward model using custom script.

Receive on HF and store the data to a file
write a custom script to read every line from a file and curl to Rest API either line-by-line or batch mode.
You can cron schedule the script to run and have a checkpoint to track where you have last read the stored file... and retry in case of target Rest API failed to receive.

---

An upvote would be appreciated & Accept solution if it helps!

Re: forwarding to third party REST endpoint

vijay — Mon, 28 Jun 2021 20:27:35 GMT

Thanks for the help @venkatasri .

Re: forwarding to third party REST endpoint

venkatasri — Mon, 28 Jun 2021 21:46:10 GMT

@vijay

I want to correct first bullet point about custom setup, you can not enforce HF to store data on file it can only index the data. Hence you have to implement script on the machine where originally present. Hope it helps Appreciate if you could Accept the solution.