Adding custom key-value pairs as part of the message in CEF format


Hi Team,
I would like to forward the syslog message output as CEF format and also would like to add additional custom key-value pairs and forward this message to the Thirdparty tool.

Can anyone let me know if my above need can be fulfilled by the "Splunk Real-Time Output" tool?

Thanks in advance.

Tags (2)
0 Karma


Splunk app cef does this in a easy way (it replace Splunk realtime output app)

0 Karma

Ultra Champion

Please refrain from posting the same question several times.

0 Karma
Get Updates on the Splunk Community!

Splunk Lantern | Spotlight on Security: Adoption Motions, War Stories, and More

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Cloud | Empowering Splunk Administrators with Admin Config Service (ACS)

Greetings, Splunk Cloud Admins and Splunk enthusiasts! The Admin Configuration Service (ACS) team is excited ...

Tech Talk | One Log to Rule Them All

One log to rule them all: how you can centralize your troubleshooting with Splunk logs We know how important ...