How can I forward old data to 3rd party systems?

caili · ‎05-19-2016

I referred to the document as shown in http://docs.splunk.com/Documentation/Splunk/6.4.1/Forwarding/Forwarddatatothird-partysystemsd

I can forward the new data which are first indexed to 3rd-party systems, but the old data indexed before can't be forwarded

How can I solve it?

Thanks in advance.

jkat54 · ‎05-19-2016

You have several options...

Cold to frozen script <- will push data being deleted due to age / size to third party
ODBC Connector <- will allow you to pull data out of splunk and into third party system
Custom REST script <- will allow you to pull data out of splunk and into third party system

How can I forward old data to 3rd party systems?

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Think Like an Architect: Introducing the Splunk Certified Cybersecurity Defense ...

Index This | What has goals but no motivation?

Deep Dive: Accelerate threat investigation with Splunk’s AI Assistant in Security

Join the Conversation

How can I forward old data to 3rd party systems?

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Think Like an Architect: Introducing the Splunk Certified Cybersecurity Defense ...

Index This | What has goals but no motivation?

Deep Dive: Accelerate threat investigation with Splunk’s AI Assistant in Security