topic Is there a way to transfer data from Splunk Search Head via Scheduled Search to third party system through syslog? in Getting Data In

Is there a way to transfer data from Splunk Search Head via Scheduled Search to third party system through syslog?

potnuru — Wed, 16 Sep 2020 13:43:49 GMT

Requirement is to send data from Splunk to PTA tool using Scheduled Search on Search Head.

The Data should be filtered on some parameters and filtered data/events are sent to PTA in regular intervals. Like Every one hours the Events should be filtered and sent to PTA.

Re: Is there a way to transfer data from Splunk Search Head via Scheduled Search to third party system through syslog?

thambisetty — Wed, 16 Sep 2020 14:12:08 GMT

I don't know what is your case. you can do using below procedure:

create your search and write your results to csv file using outputcsv command.
create inputs.conf to monitor the file and create outputs.conf to forward data using [syslog] on search head.

Re: Is there a way to transfer data from Splunk Search Head via Scheduled Search to third party system through syslog?

potnuru — Mon, 21 Sep 2020 10:36:30 GMT

@thambisetty We need to forward the raw data from Splunk to CyberArk PTA(3rd Party) tool.

We need to forward the data through SYSLOG TCP. (PTA will listen to SYSLOG TCP on xyz port).

Is there any option to forward the data from Search Head without saving it locally?

Re: Is there a way to transfer data from Splunk Search Head via Scheduled Search to third party system through syslog?

thambisetty — Mon, 21 Sep 2020 12:24:13 GMT

you can't directly forward the search results from search head to 3rd party servers.

you can do it directly from Heavy forwarder/Indexer to 3rd syslog server.

https://docs.splunk.com/Documentation/Splunk/8.0.6/Search/Forwarddatatothirdpartysystems#:~:text=To%20forward%20data%20to%20third,conf%20files.