topic Re: Forwarding attachment files in Splunk in Getting Data In

Forwarding attachment files in Splunk

samiomer — Wed, 24 Aug 2011 17:19:19 GMT

Hello,

Is it possible to forward file attachments between Splunks?

Re: Forwarding attachment files in Splunk

Ayn — Wed, 24 Aug 2011 17:42:01 GMT

Please clarify what you mean. What kind of file attachments?

Re: Forwarding attachment files in Splunk

jbsplunk — Wed, 24 Aug 2011 22:09:59 GMT

I am almost certain that this is not possible, but I'd need to understand your specific use case to be sure.

Re: Forwarding attachment files in Splunk

samiomer — Fri, 26 Aug 2011 06:31:50 GMT

For example, if there's an event that references a file on a forwarding-slunk machine, would I be able to make it forward a file attachment along with the event?

Thanks

Re: Forwarding attachment files in Splunk

Ayn — Fri, 26 Aug 2011 07:04:20 GMT

No, there is no such functionality in Splunk. What you could do is trigger a script that does something with the file (like copying it to a fileshare somewhere) but that process would be separate from Splunk.