Are you a member of the Splunk Community?
- Find Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- How to forward extracted data from Splunk to 3rd p...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
How to forward extracted data from Splunk to 3rd party?
I have a requirement where I will be getting logs from various sources in Splunk, extract some useful information from it and then again I need to forward that extracted information to a 3rd party. I've been able to collect the logs and extract information from it but I want to know how can I forward that extracted information to 3rd party.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Depending on the need, you can extract to a csv file and transmit, or create a search that generates an email with data inline or attached. You could also generate a REST call and POST the data somewhere, or a hundred other things.
When deciding on your solution, be sure to consider the type of data that is in your report. If the data is at all confidential, then you need to be transmitting in a secure way, which would argue for something other than a clear text email.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I don't want the report to be transmitted. I just want to extract some fields from the original log and then forward it to the 3rd party. Forwarding can be in syslog format.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
What options are available to send the data to the 3rd party? Would it be enough to run reports that email csv files? Do you have to send specific bits of raw logs to them via syslog?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Well forwarding the data in syslog format would be fine to 3rd party.
Calling All Security Pros: Ready to Race Through Boston?
Beyond Detection: How Splunk and Cisco Integrated Security Platforms Transform ...
Customer success is front and center at .conf25
