Are you a member of the Splunk Community?
- Find Answers
- :
- Using Splunk
- :
- Dashboards & Visualizations
- :
- how to send newly added events in the data source ...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
hi, im new to splunk. I've been playing around with splunk-javascript api for few days. My purpose of using splunk is as a log management system, Where i want it to send any newly added events in the data-source to the client in real-time. I don't want to perform any search operation and return filtered data, but all the data in the data-source. I was able to use search 'all' and retrieve data from splunk. but i couldn't configure the splunk to send newly added log-data to the client as and when it is occurred. Can anyone help me?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
It depends a bit on what you mean by "client". You can do real-time searches in Splunk - that is, you issue a search and specify the time range to be "real-time", and Splunk will send back results to you as they come in.
I don't know if this qualifies for your scenario or if it's a requirement that Splunk will send these events to you somehow without you having to issue a search at all. If you simply want to forward events automatically like that instead, you can setup some kind of process that Splunk can send data as raw TCP to. Have a look at the docs concerning this here: http://docs.splunk.com/Documentation/Splunk/6.0.2/Forwarding/Forwarddatatothird-partysystemsd
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
It depends a bit on what you mean by "client". You can do real-time searches in Splunk - that is, you issue a search and specify the time range to be "real-time", and Splunk will send back results to you as they come in.
I don't know if this qualifies for your scenario or if it's a requirement that Splunk will send these events to you somehow without you having to issue a search at all. If you simply want to forward events automatically like that instead, you can setup some kind of process that Splunk can send data as raw TCP to. Have a look at the docs concerning this here: http://docs.splunk.com/Documentation/Splunk/6.0.2/Forwarding/Forwarddatatothird-partysystemsd
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
This helped. Thanks.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
is it possible to listen to real-time updates in server from splunk sdk?
Calling All Security Pros: Ready to Race Through Boston?
Beyond Detection: How Splunk and Cisco Integrated Security Platforms Transform ...
Customer success is front and center at .conf25
