All Apps and Add-ons

How to configure the Wazuh app to get data into Splunk?


We have just started testing out Wazuh in our lab, and wanted to get that data Splunk'd.

It looks like the Wazuh App has a configuration entry for the Wazuh manager's API credentials. But the guide also states that a Forwarder be installed on the Wazuh manager:

That seems redundant. Before I tear apart the bits to see how it works, can somebody clear this up for me?


0 Karma


Hello @TheBeaker,

It's needed to set up data forwarding and also a connection with the Wazuh API in order to the app can work properly. This is because the app currently works with two data sources. From the app, you can:

  • Visualize Wazuh indexed data and perform searches, so it's necessary to forward the alerts from the Wazuh manager to Splunk.
  • Get information and make use of the Wazuh API functionalities. For instance, get information about your cluster status, manage and configure your configuration groups and much more features in 'real time' are done just by requesting to the Wazuh API.

I hope that helps, you can join to the mailing list:!forum/wazuh
or join to our community Slack channel:
Also, you can open an issue in our app repository:


0 Karma

New Member

Please read my question again. I think you may have answered someone else's question by accident, as it has nothing to do with my post. Thanks!

0 Karma


Got it! The answer was just edited.

0 Karma
Get Updates on the Splunk Community!

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...