Hello,
We're acquiring a company which uses ELK. I've been asked to look into connecting out logging infra to share data etc.
1) Is there a way for a Splunk SHC to search logstash?
2) Is there system for Kibana to hit Splunk indexers?
Any thoughts, blogs, rambling or comments are welcome.
You can search an elasticsearch instance from Splunk:
https://github.com/hvandenb/splunk-elasticsearch
I personally haven't seen any add-ons or customized versions of Kibana that allow it to search Splunk.
You could have logstash agents forward data to splunk (probably using syslog or a tcp socket). I'm not sure about forwarding splunk forwarder data into elasticsearch; you'd need some intermediary to pass the data, say syslog/tcp to logstash, then to elasticsearch.
Logstash has numerous output plugins that could be used to redirect data flows into Splunk.
https://www.elastic.co/guide/en/logstash/current/output-plugins.html
You can search an elasticsearch instance from Splunk:
https://github.com/hvandenb/splunk-elasticsearch
I personally haven't seen any add-ons or customized versions of Kibana that allow it to search Splunk.
You could have logstash agents forward data to splunk (probably using syslog or a tcp socket). I'm not sure about forwarding splunk forwarder data into elasticsearch; you'd need some intermediary to pass the data, say syslog/tcp to logstash, then to elasticsearch.