Getting Data In

How to forward data from my Splunk Enterprise instance to downstream third party SIEM appliance or LogLogic LMI?

mtadakam
New Member

We are looking to send data from our Splunk enterprise to LogLogic LMI or a third party instance. Any idea how to do that?

Thanks!

0 Karma

Richfez
SplunkTrust
SplunkTrust

A last option I can think of is to use the Splunk ODBC driver to pull out the old data.

0 Karma

maciep
Champion

i could be wrong, but i think the only way to get data out of splunk is to search for it. So maybe you could run searches, export the results and import to another tool? If you can hit splunk's rest endpoint from the other tool, run a search, and process the results in that tool?

i'm pretty sure i opened an enhancement request a long time ago to allow for exporting large amounts of data w/o having to run a search, but doubt it's anywhere near the top of their list or on it at all.

0 Karma

skalliger
Motivator

Hi,

you might want to take a look into the documentation here: https://docs.splunk.com/Documentation/Splunk/6.6.3/Forwarding/Forwarddatatothird-partysystemsd
You can forward events via syslog.

Skalli

0 Karma

mtadakam
New Member

Thank you for the information. In our case Splunk already has the data, syslog data that's stored in Splunk for about an year. I think this routing page is for data as it comes into the system and not the data that already exists on the system. To clarify my question, we need to dump the existing data (older data) from this Splunk instance and transfer it to LogLogic LMI. Is there a way / app that Splunk has that can do it? Please let me know.

0 Karma
Get Updates on the Splunk Community!

Discover Powerful New Features in Splunk Cloud Platform: Enhanced Analytics, ...

Hey Splunky people! We are excited to share the latest updates in Splunk Cloud Platform 9.3.2408. In this ...

Splunk Classroom Chronicles: Training Tales and Testimonials

Welcome to the "Splunk Classroom Chronicles" series, created to help curious, career-minded learners get ...

Access Tokens Page - New & Improved

Splunk Observability Cloud recently launched an improved design for the access tokens page for better ...