Splunk <-> ELK

[daniel333]

Hello,

We're acquiring a company which uses ELK. I've been asked to look into connecting out logging infra to share data etc.
1) Is there a way for a Splunk SHC to search logstash?
2) Is there system for Kibana to hit Splunk indexers?

Any thoughts, blogs, rambling or comments are welcome.

[Damien_Dallimor]

Logstash has numerous output plugins that could be used to redirect data flows into Splunk.

https://www.elastic.co/guide/en/logstash/current/output-plugins.html

[Jeremiah · Accepted solution]

You can search an elasticsearch instance from Splunk:

https://github.com/hvandenb/splunk-elasticsearch

I personally haven't seen any add-ons or customized versions of Kibana that allow it to search Splunk.

You could have logstash agents forward data to splunk (probably using syslog or a tcp socket). I'm not sure about forwarding splunk forwarder data into elasticsearch; you'd need some intermediary to pass the data, say syslog/tcp to logstash, then to elasticsearch.