Deployment Architecture

Spunk deployment - as a data collector/forwarder?

mmioneatdtcc
Engager

I have a somewhat odd deployment idea that I am trying to leverage Splunk for in place of another off the shelf tool. We are in the process of replacing an event management tool that ingests events from multiple end devices and other tools as part of an infrastructure monitoring function. The potential issue is that the to be end visualization tool may not have a mechanism to ingest and normalize multiple data sources (SNMP Traps, Syslog, Email, SCOM events, other monitoring tool events).

So I'm interested to know if Splunk can sit between the various data sources, ingest, normalize and forward those alerts so that this new northbound tool could further process these events for further processing. This is a gross oversimplification however I am just curious to know if anyone has used Splunk in such a way.

If you did I'd like to hear about it.

Thanks,
Mike M

Tags (1)

mmioneatdtcc
Engager

Hi,

its possible but if we're processing somewhere between the ballpark of 10k to several 100k of events a day (possibly into the millions), I'm not certain if email will scale with the potential volume.

Rgds,
Mike M

0 Karma

dbcase
Motivator

One simple way is that most off the shelf monitoring tools can accept incoming emails and use them for alerts. You could have Splunk Alert->send email to the northbound monitoring system, would something like that work?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...