There are many ways to send alerts from Splunk and have OMNIbus create events. One of the simplest ways would be to have Splunk write alert data via a standard alert action, line by line, into a flat file. Then use an OMNIbus flatfile gateway to read that file, take the contents, and create events in the Objectserver.
The flatfile gateway is lightweight enough that it can sit on a Splunk search head without creating too much overhead.
This has the advantage of using many capabilities native to OMNIbus, such as reliable delivery and store and forward.
Other ways of getting alert data could be using a command line like "logger" to log syslog containing Splunk alert data, and then use an OMNIbus syslog probe to pull data in. Or traps, and use an OMNIbus SNMP probe. Or use Splunk's DB Connect app to write results of searches to a database table, and have an OMNIbus database gateway bring the data into the Objectserver. Or have an alert action send to a socket and use an OMNIbus socket probe.
As you can see, there are many ways to do this. If you are going to do much with alert actions, I highly recommend Ron Naken's "Red Alert" app - it's like legos for Splunk alerting!
