Deployment Architecture

forwarding to third party REST endpoint

vijay
Engager

Hi,

Is it possible  from Splunk universal/heavy forwarder to forward data to third party REST API endpoint over https using basic authentication ?

I have use case where Splunk universal/heavy forwarder has to forward data to Splunk enterprise + 3rd party client REST api endpoint for processing data.

Is this use case possible ?

 

 

Labels (1)
0 Karma
1 Solution

venkatasri
SplunkTrust
SplunkTrust

@vijay 

I want to correct first bullet point about custom setup, you can not enforce HF to store data on file it can only index the data. Hence you have to implement script on the machine where originally present. Hope it helps Appreciate if you could Accept the solution.

View solution in original post

venkatasri
SplunkTrust
SplunkTrust

Hi @vijay 

Splunk docs suggest HF can forward to only TCP endpoint not to HTTP Rest API. You can find same documentation here - Forward data to third-party systems - Splunk Documentation

If you wish to do so i would do using store-and-forward model using custom script.

  • Receive on HF and store the data to a file
  • write a custom script to read every line from a file and curl to Rest API either line-by-line or batch mode.
  • You can cron schedule the script to run and have a checkpoint to track where you have last read the stored file... and retry in case of target Rest API failed to receive.

---

An upvote would be appreciated & Accept solution if it helps!

0 Karma

vijay
Engager

Thanks for the help @venkatasri .

0 Karma

venkatasri
SplunkTrust
SplunkTrust

@vijay 

I want to correct first bullet point about custom setup, you can not enforce HF to store data on file it can only index the data. Hence you have to implement script on the machine where originally present. Hope it helps Appreciate if you could Accept the solution.

Get Updates on the Splunk Community!

SOAR Tenable.sc scan endpoint with credentials

When scanning an endpoint in SOAR how to you get a credential scan? I can start a scan via SOAR playbook but ...

KVStore failure after upgrade to 9.0

After upgrading to Splunk 9.0 on a single instance, we occasionally get KV Store errors.&nbsp;<span ...

Is there an add-on for the Cisco Meraki devices?

We have many&nbsp;Cisco Meraki devices sending data via syslog to Splunk. Is there an add-on for ...