How to forward data from my Splunk Enterprise instance to downstream third party SIEM appliance or LogLogic LMI?

[mtadakam]

We are looking to send data from our Splunk enterprise to LogLogic LMI or a third party instance. Any idea how to do that?

Thanks!

[Richfez]

A last option I can think of is to use the Splunk ODBC driver to pull out the old data.

[maciep]

i could be wrong, but i think the only way to get data out of splunk is to search for it. So maybe you could run searches, export the results and import to another tool? If you can hit splunk's rest endpoint from the other tool, run a search, and process the results in that tool?

i'm pretty sure i opened an enhancement request a long time ago to allow for exporting large amounts of data w/o having to run a search, but doubt it's anywhere near the top of their list or on it at all.

[skalliger]

Hi,

you might want to take a look into the documentation here: https://docs.splunk.com/Documentation/Splunk/6.6.3/Forwarding/Forwarddatatothird-partysystemsd
You can forward events via syslog.

Skalli

[mtadakam]

Thank you for the information. In our case Splunk already has the data, syslog data that's stored in Splunk for about an year. I think this routing page is for data as it comes into the system and not the data that already exists on the system. To clarify my question, we need to dump the existing data (older data) from this Splunk instance and transfer it to LogLogic LMI. Is there a way / app that Splunk has that can do it? Please let me know.