Due to architecture reasons I need to use Apache Kafka as a message broker between Splunk Forwarders and Splunk cluster.
So, the data flow would be something like:
Splunk Forwarder ----(SSL)---> Kafka Topic ----(SSL)---> Splunk Indexers
So my questions would be:
Can Splunk forwarder send data directly to Kafka topic? I see the same question in 2015, we are in 2017. The answer was NO. Is it the same answer today?
I see that Indexers can read from Kafka using modular inputs or add-ons so, this point shouldn't be a problem.
Can Splunk send data to Kafka topic? (in order for instance to send alerts to other platforms) I see the answer is no, is it correct in 2017:
Both links above suggest use Heavy Forwarders. Are Heavy Forwarders deprecated? I have heard that. Is it recommended to use them to provide a solution for this?
Hi, Although this data is not cooked (it does not contained timestamp, host, etc ..) you can send data to third party: https://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Forwarddatatothird-partysystemsd
From there send it to Kafka.