Getting Data In

How do I go about the integration with Global Relay?

spl_aficionado
Path Finder

One of our clients is asking for a fresh integration with Global Relay as a replacement for ZL Archive, how do I go about it?

Labels (1)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

More words please.

Most importantly - how does it relate to your customer's Splunk?

0 Karma

spl_aficionado
Path Finder

Hi @PickleRick

We would like to know how to integrate Global Relay with Splunk ingestion wise, determine what data and events need to be collected, and identify any connectivity requirements (internal vs. external hosting). I'm not sure whether Global Relay usually has an internal presence in the company or they are outside the company. 

0 Karma

PickleRick
SplunkTrust
SplunkTrust

OK. For starters, I don't actually know either solutions (the ZL Archive mentioned before or the Global Relay) - just googled what they do.

But.

The main question is not what "needs to be collected", because that is something that should stem from the business needs. The question might be what can be collected. Either you build your business case from the business need and verify if it can be achieved with the service provider (in other words, your business says - we want to be able to track this and that and you verify if either of those providers give you means of retrieving such data) or you go the other way around - check what data you are able to ingest from there and verify if there is any business case for that.

A quick browse through their website doesn't yield very optimistic results. The only docs about any kind of API I could find was about sending data into their platform. I'm not sure if there is any way of either getting the data out of it or getting any form of automated query, retrieving audit records and so on. At least there's no easily available info on that. That might be a thing you need to contact their support about.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

From Data to Insight: Announcing the Winners of the Splunk Dashboard Contest

Hi Splunkers, First off, thank you to everyone who participated in our very first From Data to Insight: The ...

Splunk Developers: Construct Your Future at the .conf26 Builder Bar

Calling all Splunk architects, platform admins, and app developers: the site is open, and the blueprints are ...

Quick connection discovery mode for forwarders

When a Splunk forwarder loses connectivity to its indexers, it does not always reconnect immediately. In many ...