All Apps and Add-ons

about forwarding data from Splunk to non-Splunk side

makhambayeva
New Member

How can we forward data from Splunk to non-Splunk (third side)?
In fact, I need to forward all data, which came on specific port on Splunk, to another SIEM.
Do I need to configure only outputs.conf or i need to configure reseiver also? and how?

0 Karma

solarboyz1
Builder

If you want to send all data to BOTH splunk and non-splunk, you should only need to modify your outputs.conf:.
https://docs.splunk.com/Documentation/Forwarder/7.2.5/Forwarder/Configureforwardingwithoutputs.conf

[tcpout]
defaultGroup=splunk, siem 

[tcpout:splunk]
disabled=false
server=10.1.12.1:9997

[tcpout:siem]
disabled=false
sendCookedData=false
server=10.1.12.2:1234
0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...