Is there a way to transfer data from Splunk Search Head via Scheduled Search to third party system through syslog?

[potnuru]

Requirement is to send data from Splunk to PTA tool using Scheduled Search on Search Head.

The Data should be filtered on some parameters and filtered data/events are sent to PTA in regular intervals. Like Every one hours the Events should be filtered and sent to PTA.

[thambisetty]

you can't directly forward the search results from search head to 3rd party servers.

you can do it directly from Heavy forwarder/Indexer to 3rd syslog server.

https://docs.splunk.com/Documentation/Splunk/8.0.6/Search/Forwarddatatothirdpartysystems#:~:text=To%....

[thambisetty]

I don't know what is your case. you can do using below procedure:

1. create your search and write your results to csv file using outputcsv command.
2. create inputs.conf to monitor the file and create outputs.conf to forward data using [syslog] on search head.

[potnuru]

@thambisetty We need to forward the raw data from Splunk to CyberArk PTA(3rd Party) tool.

We need to forward the data through SYSLOG TCP. (PTA will listen to SYSLOG TCP on xyz port).

Is there any option to forward the data from Search Head without saving it locally?