How to forwarded logs from Splunk to MCAS

[rayar]

Hi

What will be the best way to implement the below request ?

We need to configure the some logs to be forwarded from Splunk to MCAS Server (Server in the same network like Splunk server )
Logs should be forwarded in Syslog or FTP and based on a specific query

[richgalloway · Accepted solution]

See the docs at https://docs.splunk.com/Documentation/Splunk/8.0.3/Forwarding/Forwarddatatothird-partysystemsd . While some filtering is possible, you cannot forward the results of a query.

[rayar]

Hi
I am getting "Hi! This page does not exist, or has been removed from the Documentation."
so is there another way to send search results to external system ?

[richgalloway]

Splunk didn't like the period at the end of the sentence. Try the revised answer.

[rayar]

thanks , I was able to open the doc

so there is no way to sent the results of such query to external system ?

index=websense AND act="Permitted"
| fields _time, suser, src, dst, act, request, in, out
| convert timeformat="%Y-%m-%d %H:%M:%S" ctime(_time) as Time
| table Time, suser, src, dst, act, request, in, out

[richgalloway]

No straightforward way. You could schedule a report that saves query results in a CSV file and use a cron job to ship that file to another system.

[rayar]

and if I want to send in CEF format to the MCAS server
where I define the target server ?

[richgalloway]

Your cron job could invoke a Python script that does the conversion. The target server could be in the script or an external configurable.

[rayar]

Thanks a lot