Forwarding all events from a Splunk Instance

npatellis · ‎03-14-2011

I am using Splunk to collect logs from a diverse environment. The same events, or at least a large subset, need to be forwarded to security event integration management device. What I want to avoid is having a Windows server send logs to two security devices - Splunk and the security event manager. Is it possible to have Splunk collect while also forwarding?

I-Man · ‎03-14-2011

Yes it is. This link should lead you in the right direction.

http://www.splunk.com/base/Documentation/4.1.6/Admin/Forwarddatatothird-partysystems

I am forwarding almost all of our data to an IDS. We did filter some junk out prior to being indexed or forwarded. The following link will help you filter out some of the data that you do not want to forward.

http://www.splunk.com/base/Documentation/4.1.5/Admin/Routeandfilterdata#Filter_event_data_and_send_t...

I-Man

Forwarding all events from a Splunk Instance

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Think Like an Architect: Introducing the Splunk Certified Cybersecurity Defense ...

Index This | What has goals but no motivation?

Deep Dive: Accelerate threat investigation with Splunk’s AI Assistant in Security

Join the Conversation

Forwarding all events from a Splunk Instance

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Think Like an Architect: Introducing the Splunk Certified Cybersecurity Defense ...

Index This | What has goals but no motivation?

Deep Dive: Accelerate threat investigation with Splunk’s AI Assistant in Security