All Apps and Add-ons

about forwarding data from Splunk to non-Splunk side

makhambayeva
New Member

How can we forward data from Splunk to non-Splunk (third side)?
In fact, I need to forward all data, which came on specific port on Splunk, to another SIEM.
Do I need to configure only outputs.conf or i need to configure reseiver also? and how?

0 Karma

solarboyz1
Builder

If you want to send all data to BOTH splunk and non-splunk, you should only need to modify your outputs.conf:.
https://docs.splunk.com/Documentation/Forwarder/7.2.5/Forwarder/Configureforwardingwithoutputs.conf

[tcpout]
defaultGroup=splunk, siem 

[tcpout:splunk]
disabled=false
server=10.1.12.1:9997

[tcpout:siem]
disabled=false
sendCookedData=false
server=10.1.12.2:1234
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...