Deployment Architecture

Spunk deployment - as a data collector/forwarder?

mmioneatdtcc
Engager

I have a somewhat odd deployment idea that I am trying to leverage Splunk for in place of another off the shelf tool. We are in the process of replacing an event management tool that ingests events from multiple end devices and other tools as part of an infrastructure monitoring function. The potential issue is that the to be end visualization tool may not have a mechanism to ingest and normalize multiple data sources (SNMP Traps, Syslog, Email, SCOM events, other monitoring tool events).

So I'm interested to know if Splunk can sit between the various data sources, ingest, normalize and forward those alerts so that this new northbound tool could further process these events for further processing. This is a gross oversimplification however I am just curious to know if anyone has used Splunk in such a way.

If you did I'd like to hear about it.

Thanks,
Mike M

Tags (1)

dbcase
Motivator

mmioneatdtcc
Engager

Hi,

its possible but if we're processing somewhere between the ballpark of 10k to several 100k of events a day (possibly into the millions), I'm not certain if email will scale with the potential volume.

Rgds,
Mike M

0 Karma

dbcase
Motivator

One simple way is that most off the shelf monitoring tools can accept incoming emails and use them for alerts. You could have Splunk Alert->send email to the northbound monitoring system, would something like that work?

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>