Send Forwarder data from Splunk server as arguments

[kuzkuz]

Hello,

We have a deployment App (modular Powershell) used on clients using the forwarder, I'm interested in passing data from Splunk Enterprise into the clients so this data can be used by the App to take actions, run specific sections, etc..

Can we send specific data to each forwarder from the server?

For example:
1. Run actions based on the ESX CPU that the Client is hosted
2. Run some kind of validation test based on a product reported from a different data source)

Thanks!

[kuzkuz]

For anyone else looking an answer, we implemented a set of PowerShell functions that read data from Splunk using REST API and taking the needed action based on the result

[skoelpin]

I've done something similar but used an external tool (UC4 Automic) to do this. Splunk would trigger an alert which would then kick off the workflow in Automic. If you didn't have a workflow automation tool, then you will need to script this yourself.

First setup an alert in Splunk which will send a REST call to your remote servers which would then kick off a script which can validate your conditions