topic Migration of data from Splunk to ELK in Splunk Search https://community.splunk.com/t5/Splunk-Search/Migration-of-data-from-Splunk-to-ELK/m-p/685310#M233836 <P>Hi</P><P>&nbsp;</P><P>We are trying to integrate the data which is on Splunk to ELK, Using Heavy forwarder can anyone suggest how inputs.conf can be configured so that it listens to the data which is on search head and then using outputs.conf we can send the data to ELK via stash</P><P>&nbsp;</P><P>Thanks&nbsp;</P> Wed, 24 Apr 2024 12:15:09 GMT NOORULAINE 2024-04-24T12:15:09Z Migration of data from Splunk to ELK https://community.splunk.com/t5/Splunk-Search/Migration-of-data-from-Splunk-to-ELK/m-p/685310#M233836 <P>Hi</P><P>&nbsp;</P><P>We are trying to integrate the data which is on Splunk to ELK, Using Heavy forwarder can anyone suggest how inputs.conf can be configured so that it listens to the data which is on search head and then using outputs.conf we can send the data to ELK via stash</P><P>&nbsp;</P><P>Thanks&nbsp;</P> Wed, 24 Apr 2024 12:15:09 GMT https://community.splunk.com/t5/Splunk-Search/Migration-of-data-from-Splunk-to-ELK/m-p/685310#M233836 NOORULAINE 2024-04-24T12:15:09Z Re: Migration of data from Splunk to ELK https://community.splunk.com/t5/Splunk-Search/Migration-of-data-from-Splunk-to-ELK/m-p/685339#M233844 <P>Splunk heavy forwarders (and indexers) send data to third-party services in syslog format only.&nbsp; They do not (and cannot) listen to data on a search head (SHs do not have data).</P><P>Place heavy forwarders in front of your indexers to route data both to the indexers and to ELK.&nbsp; See <A href="https://docs.splunk.com/Documentation/Splunk/9.2.1/Forwarding/Routeandfilterdatad#Replicate_a_subset_of_data_to_a_third-party_system" target="_blank">https://docs.splunk.com/Documentation/Splunk/9.2.1/Forwarding/Routeandfilterdatad#Replicate_a_subset_of_data_to_a_third-party_system</A> for more information.</P><P>Be aware that this is a bit of a Science Project.&nbsp; Splunk does not make it easy to switch to a competing product.</P> Wed, 24 Apr 2024 14:47:48 GMT https://community.splunk.com/t5/Splunk-Search/Migration-of-data-from-Splunk-to-ELK/m-p/685339#M233844 richgalloway 2024-04-24T14:47:48Z