Getting Data In

Forwarding all events from a Splunk Instance

Explorer

I am using Splunk to collect logs from a diverse environment. The same events, or at least a large subset, need to be forwarded to security event integration management device. What I want to avoid is having a Windows server send logs to two security devices - Splunk and the security event manager. Is it possible to have Splunk collect while also forwarding?

Tags (2)
0 Karma

Communicator

Yes it is. This link should lead you in the right direction.

http://www.splunk.com/base/Documentation/4.1.6/Admin/Forwarddatatothird-partysystems

I am forwarding almost all of our data to an IDS. We did filter some junk out prior to being indexed or forwarded. The following link will help you filter out some of the data that you do not want to forward.

http://www.splunk.com/base/Documentation/4.1.5/Admin/Routeandfilterdata#Filter_event_data_and_send_t...

I-Man

State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!