https://community.splunk.com/t5/Getting-Data-In/How-to-forward-data-from-my-Splunk-Enterprise-instance-to/m-p/334889#M93433 <P>i could be wrong, but i think the only way to get data out of splunk is to search for it. So maybe you could run searches, export the results and import to another tool? If you can hit splunk's rest endpoint from the other tool, run a search, and process the results in that tool?</P> <P>i'm pretty sure i opened an enhancement request a long time ago to allow for exporting large amounts of data w/o having to run a search, but doubt it's anywhere near the top of their list or on it at all.</P> Sat, 27 Jan 2018 02:14:43 GMT maciep 2018-01-27T02:14:43Z https://community.splunk.com/t5/Getting-Data-In/How-to-forward-data-from-my-Splunk-Enterprise-instance-to/m-p/334886#M93430 <P>We are looking to send data from our Splunk enterprise to LogLogic LMI or a third party instance. Any idea how to do that? </P> <P>Thanks!</P> Thu, 25 Jan 2018 16:08:46 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-forward-data-from-my-Splunk-Enterprise-instance-to/m-p/334886#M93430 mtadakam 2018-01-25T16:08:46Z https://community.splunk.com/t5/Getting-Data-In/How-to-forward-data-from-my-Splunk-Enterprise-instance-to/m-p/334887#M93431 <P>Hi,</P> <P>you might want to take a look into the documentation here: <A href="https://docs.splunk.com/Documentation/Splunk/6.6.3/Forwarding/Forwarddatatothird-partysystemsd">https://docs.splunk.com/Documentation/Splunk/6.6.3/Forwarding/Forwarddatatothird-partysystemsd</A><BR /> You can forward events via syslog.</P> <P>Skalli</P> Fri, 26 Jan 2018 12:58:34 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-forward-data-from-my-Splunk-Enterprise-instance-to/m-p/334887#M93431 skalliger 2018-01-26T12:58:34Z https://community.splunk.com/t5/Getting-Data-In/How-to-forward-data-from-my-Splunk-Enterprise-instance-to/m-p/334888#M93432 <P>Thank you for the information. In our case Splunk already has the data, syslog data that's stored in Splunk for about an year. I think this routing page is for data as it comes into the system and not the data that already exists on the system. To clarify my question, we need to dump the existing data (older data) from this Splunk instance and transfer it to LogLogic LMI. Is there a way / app that Splunk has that can do it? Please let me know.</P> Fri, 26 Jan 2018 17:13:14 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-forward-data-from-my-Splunk-Enterprise-instance-to/m-p/334888#M93432 mtadakam 2018-01-26T17:13:14Z https://community.splunk.com/t5/Getting-Data-In/How-to-forward-data-from-my-Splunk-Enterprise-instance-to/m-p/334889#M93433 <P>i could be wrong, but i think the only way to get data out of splunk is to search for it. So maybe you could run searches, export the results and import to another tool? If you can hit splunk's rest endpoint from the other tool, run a search, and process the results in that tool?</P> <P>i'm pretty sure i opened an enhancement request a long time ago to allow for exporting large amounts of data w/o having to run a search, but doubt it's anywhere near the top of their list or on it at all.</P> Sat, 27 Jan 2018 02:14:43 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-forward-data-from-my-Splunk-Enterprise-instance-to/m-p/334889#M93433 maciep 2018-01-27T02:14:43Z https://community.splunk.com/t5/Getting-Data-In/How-to-forward-data-from-my-Splunk-Enterprise-instance-to/m-p/334890#M93434 <P>A last option I can think of is to use the <A href="http://docs.splunk.com/Documentation/ODBC/2.1.1/UseODBC/AboutSplunkODBCDriver">Splunk ODBC driver</A> to pull out the old data.</P> Sun, 28 Jan 2018 13:26:03 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-forward-data-from-my-Splunk-Enterprise-instance-to/m-p/334890#M93434 Richfez 2018-01-28T13:26:03Z