Getting Data In

How to forward data from my Splunk Enterprise instance to downstream third party SIEM appliance or LogLogic LMI?

mtadakam
New Member

We are looking to send data from our Splunk enterprise to LogLogic LMI or a third party instance. Any idea how to do that?

Thanks!

0 Karma

Richfez
SplunkTrust
SplunkTrust

A last option I can think of is to use the Splunk ODBC driver to pull out the old data.

0 Karma

maciep
Champion

i could be wrong, but i think the only way to get data out of splunk is to search for it. So maybe you could run searches, export the results and import to another tool? If you can hit splunk's rest endpoint from the other tool, run a search, and process the results in that tool?

i'm pretty sure i opened an enhancement request a long time ago to allow for exporting large amounts of data w/o having to run a search, but doubt it's anywhere near the top of their list or on it at all.

0 Karma

skalliger
Motivator

Hi,

you might want to take a look into the documentation here: https://docs.splunk.com/Documentation/Splunk/6.6.3/Forwarding/Forwarddatatothird-partysystemsd
You can forward events via syslog.

Skalli

0 Karma

mtadakam
New Member

Thank you for the information. In our case Splunk already has the data, syslog data that's stored in Splunk for about an year. I think this routing page is for data as it comes into the system and not the data that already exists on the system. To clarify my question, we need to dump the existing data (older data) from this Splunk instance and transfer it to LogLogic LMI. Is there a way / app that Splunk has that can do it? Please let me know.

0 Karma
Get Updates on the Splunk Community!

Continuing Innovation & New Integrations Unlock Full Stack Observability For Your ...

You’ve probably heard the latest about AppDynamics joining the Splunk Observability portfolio, deepening our ...

Monitoring Amazon Elastic Kubernetes Service (EKS)

As we’ve seen, integrating Kubernetes environments with Splunk Observability Cloud is a quick and easy way to ...

Cloud Platform & Enterprise: Classic Dashboard Export Feature Deprecation

As of Splunk Cloud Platform 9.3.2408 and Splunk Enterprise 9.4, classic dashboard export features are now ...