Forwarding attachment files in Splunk

[samiomer]

Hello,

Is it possible to forward file attachments between Splunks?

[samiomer]

For example, if there's an event that references a file on a forwarding-slunk machine, would I be able to make it forward a file attachment along with the event?

Thanks

[Ayn]

No, there is no such functionality in Splunk. What you could do is trigger a script that does something with the file (like copying it to a fileshare somewhere) but that process would be separate from Splunk.

[jbsplunk · Accepted solution]

I am almost certain that this is not possible, but I'd need to understand your specific use case to be sure.

[Ayn]

Please clarify what you mean. What kind of file attachments?