topic Re: Using HFs and UFs to send logs to other SIEM in Getting Data In

Using HFs and UFs to send logs to other SIEM

NightShark — Tue, 05 Apr 2022 09:47:58 GMT

Greetings,

We would like to segregate a couple of our assets and forward their data onto other SIEM instances with our current full Splunk setup. Is it possible to send the same logs on the assets from their respective UFs and HFs to send data to other SIEM solutions instead of Splunk Indexers?

If possible, are there any articles and documentations that specify the detail on how the log is transferred and what steps need to be accomplished in order to achieve the final goal?

Thanks,

Best Regards,

Re: Using HFs and UFs to send logs to other SIEM

gcusello — Tue, 05 Apr 2022 09:55:57 GMT

Hi @NightShark,

yes, it's possible, for more infos, please see at :

https://docs.splunk.com/Documentation/SplunkCloud/latest/Forwarding/Forwarddatatothird-partysystemsd

https://docs.splunk.com/Documentation/Splunk/8.2.5/Forwarding/Routeandfilterdatad#Replicate_a_subset_of_data_to_a_third-party_system

then if you search in Community, you'll find many answers on this topic.

Ciao.

Giuseppe

Re: Using HFs and UFs to send logs to other SIEM

NightShark — Tue, 05 Apr 2022 11:11:40 GMT

Thank you