https://community.splunk.com/t5/Getting-Data-In/would-like-to-send-logs-from-Splunk-to-Qradar/m-p/425399#M95488 <P>Let's start with what kind of data you want to forward. Do you just want to route a copy of some of the data you ingest into splunk also to qradar? Or do you want to send the result of some search / alert / whatever to QRadar?</P> Thu, 07 Mar 2019 15:42:34 GMT FrankVl 2019-03-07T15:42:34Z https://community.splunk.com/t5/Getting-Data-In/would-like-to-send-logs-from-Splunk-to-Qradar/m-p/425398#M95487 <P>Hi,</P> <P>got a requirement to send logs from Splunk to Qradar. I have gone through few splunk docs, but I couldn't get proper idea on how to start with this requirement. I was able to find some info from IBM knowledge center, as per documentation there is a Qradar app for splunk data forwarding. but i am not sure how it will work.</P> <P>please let me know if anyone have knowledge on this? </P> <P>Thanks in advance</P> Thu, 07 Mar 2019 13:55:01 GMT https://community.splunk.com/t5/Getting-Data-In/would-like-to-send-logs-from-Splunk-to-Qradar/m-p/425398#M95487 niha1318 2019-03-07T13:55:01Z https://community.splunk.com/t5/Getting-Data-In/would-like-to-send-logs-from-Splunk-to-Qradar/m-p/425399#M95488 <P>Let's start with what kind of data you want to forward. Do you just want to route a copy of some of the data you ingest into splunk also to qradar? Or do you want to send the result of some search / alert / whatever to QRadar?</P> Thu, 07 Mar 2019 15:42:34 GMT https://community.splunk.com/t5/Getting-Data-In/would-like-to-send-logs-from-Splunk-to-Qradar/m-p/425399#M95488 FrankVl 2019-03-07T15:42:34Z https://community.splunk.com/t5/Getting-Data-In/would-like-to-send-logs-from-Splunk-to-Qradar/m-p/425400#M95489 <P>Hi,</P> <P>we have already ingested data into splunk, we got thousand's of hosts for specific IIS logs. but we don't want to send all of them, we particularly want to send 75 hosts to qradar.</P> Fri, 08 Mar 2019 10:03:40 GMT https://community.splunk.com/t5/Getting-Data-In/would-like-to-send-logs-from-Splunk-to-Qradar/m-p/425400#M95489 niha1318 2019-03-08T10:03:40Z https://community.splunk.com/t5/Getting-Data-In/would-like-to-send-logs-from-Splunk-to-Qradar/m-p/425401#M95490 <P>But do you want to export previously ingested data from Splunk, or do you want to implement a (partial) parallel feed to both platforms?</P> Fri, 08 Mar 2019 10:26:51 GMT https://community.splunk.com/t5/Getting-Data-In/would-like-to-send-logs-from-Splunk-to-Qradar/m-p/425401#M95490 FrankVl 2019-03-08T10:26:51Z https://community.splunk.com/t5/Getting-Data-In/would-like-to-send-logs-from-Splunk-to-Qradar/m-p/425402#M95491 <P>we wanted to export previously ingested data from splunk to qradar.</P> <P>Thanks,</P> Fri, 08 Mar 2019 14:06:57 GMT https://community.splunk.com/t5/Getting-Data-In/would-like-to-send-logs-from-Splunk-to-Qradar/m-p/425402#M95491 niha1318 2019-03-08T14:06:57Z https://community.splunk.com/t5/Getting-Data-In/would-like-to-send-logs-from-Splunk-to-Qradar/m-p/425403#M95492 <P><EM>"we wanted to export previously ingested data from splunk to qradar."</EM></P> <P>If it is a one off, you could do a search and export the events to csv (use the <CODE>| fields _raw</CODE> command to restrict the export to just the raw data).</P> <P>That can also be automated with a saved search that exports to CSV and I guess also through the REST API.</P> <P>For more information, see: <A href="https://docs.splunk.com/Documentation/Splunk/latest/Search/Exportsearchresults">https://docs.splunk.com/Documentation/Splunk/latest/Search/Exportsearchresults</A></P> Fri, 08 Mar 2019 14:14:32 GMT https://community.splunk.com/t5/Getting-Data-In/would-like-to-send-logs-from-Splunk-to-Qradar/m-p/425403#M95492 FrankVl 2019-03-08T14:14:32Z