Is there a way to send AMQP messages from Splunk?

eugenek — Mon, 08 Feb 2016 13:24:26 GMT

We need to publish messages based on events in Splunk. Is there a way to get Splunk to publish events using AMQP? At the moment, best I can come up with is triggering a script from an alert and writing custom code to handle publishing of messages.

Re: Is there a way to send AMQP messages from Splunk?

Jeremiah — Mon, 08 Feb 2016 14:00:47 GMT

Splunk doesn't have any built-in features to send messages to AMQP.

There is a AMQP modular input, but that takes messages from AMQP and indexes them into Splunk, not the other way around.

https://splunkbase.splunk.com/apps/#/page/1/search/amqp/order/relevance

Since there isn't an option in Splunkbase, you'll need to create something yourself. In 6.3 Splunk added custom alert actions, which let you integrate your own alert responses into Splunk. Yes you'd need to write a script, and the integrate that into Splunk. Take a look at the links below. There are many examples of other types of alert actions in Splunkbase that you can use to get started.

http://docs.splunk.com/Documentation/Splunk/6.3.3/AdvancedDev/ModAlertsIntro
https://splunkbase.splunk.com/apps/#/order/relevance/search/alert%2520action

topic Is there a way to send AMQP messages from Splunk? in Splunk Search

Is there a way to send AMQP messages from Splunk?

Re: Is there a way to send AMQP messages from Splunk?