topic Re: Splunk integration with other tool in Getting Data In

Splunk integration with other tool

splkadmin — Mon, 04 Jan 2021 11:56:44 GMT

Hello

I am having a single instance of Splunk enterprise on my environment ,Is there a way to forward the Splunk data to other SIEM product on required basis.

Could you please help us to provide the details to procedure on this.

Re: Splunk integration with other tool

scelikok — Tue, 05 Jan 2021 05:32:37 GMT

Hi @splkadmin,

You can see options sending data to third parties on below document.

https://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Forwarddatatothird-partysystemsd

If this reply helps you an upvote is appreciated.

Re: Splunk integration with other tool

splkadmin — Tue, 05 Jan 2021 10:20:27 GMT

In that case do we need to add the output.conf on each client server that i have installed a universal forwarder or should I add only to the Splunk enterprise instance that suppose to forward the all client logs to the third party server.

Re: Splunk integration with other tool

scelikok — Tue, 05 Jan 2021 11:02:28 GMT

Universal Forwarders can send data only to another Splunk instances. You should setup outputs.conf only on indexers or heavy forwarders to forward data to third party. You can select data by using host, source, sourcetype or regex based on data contents.

Re: Splunk integration with other tool

splkadmin — Wed, 13 Jan 2021 12:32:20 GMT

Thank you for your reply ..

Ok I have single instance of Splunk enterprise and installed a universal forwarder on all the client.

Now I have to sent data to third party SIEM systems..

Should I configure only output.conf or just add the forwarded IP on Splunk instance console ?

do we able to configure a props.conf and transforms.conf on same instance? or do I require heavy forwarder to do that.

Re: Splunk integration with other tool

scelikok — Wed, 13 Jan 2021 17:54:41 GMT

You can use single-instance Splunk Enterprise to forward data using methods/samples provided in the document. You do not need to have a heavy forwarder.

You need to configure outputs.conf and also props.conf, transforms.conf in order to route data.