How to forward extracted data from Splunk to 3rd party?

[thamohit]

I have a requirement where I will be getting logs from various sources in Splunk, extract some useful information from it and then again I need to forward that extracted information to a 3rd party. I've been able to collect the logs and extract information from it but I want to know how can I forward that extracted information to 3rd party.

[DalJeanis]

Depending on the need, you can extract to a csv file and transmit, or create a search that generates an email with data inline or attached. You could also generate a REST call and POST the data somewhere, or a hundred other things.

When deciding on your solution, be sure to consider the type of data that is in your report. If the data is at all confidential, then you need to be transmitting in a secure way, which would argue for something other than a clear text email.

[thamohit]

I don't want the report to be transmitted. I just want to extract some fields from the original log and then forward it to the 3rd party. Forwarding can be in syslog format.

[micahkemp]

What options are available to send the data to the 3rd party? Would it be enough to run reports that email csv files? Do you have to send specific bits of raw logs to them via syslog?

[thamohit]

Well forwarding the data in syslog format would be fine to 3rd party.