topic Send data Splunk to Splunk using HEC in Getting Data In

Send data Splunk to Splunk using HEC

aasabatini — Wed, 19 May 2021 14:20:40 GMT

Hi All,

I would to know one information.

Do you think is possible send splunk data to another splunk instance with HEC? and how?

Thanks In advance

Alessandro

venkatasri — Thu, 20 May 2021 22:06:45 GMT

The data already ingested to source splunk which needs to be exported out and ingest to target Splunk via HEC?

aasabatini — Fri, 21 May 2021 05:46:05 GMT

Yes, a splunk instance forward data with HEC on another splunk instace

venkatasri — Fri, 21 May 2021 06:53:13 GMT

Ok. There seems no direct out-of-the box solution. You need to customize it, if you know what logs you need to export out from source splunk write a

Option 1 (Preferred): custom script to query source Splunk using REST API and store it in a file on host you actually query the results. Stored file can be ingested to target Splunk by installing UF on it and configure monitor
Option 2: custom script to query the source Splunk using REST API, and continue ingest to target Splunk via HEC in a batch mode with HEC acknowledgement enabled on target Splunk. You can have additional functionality for resending logs to target Splunk in case you do not get positive acknowledgement.

Note: You will be charged for license in both Splunk instances if your license type is volume based (per GB).

------------------------------------------------------

An upvote would be appreciated if it helps!