Getting Data In

Is there a way to transfer data from Splunk Search Head via Scheduled Search to third party system through syslog?

potnuru
Path Finder

Requirement is to send data from Splunk to PTA tool using Scheduled Search on Search Head.

The Data should be filtered on some parameters and filtered data/events are sent to PTA in regular intervals. Like Every one hours the Events should be filtered and sent to PTA.

 

Labels (1)
0 Karma

thambisetty
SplunkTrust
SplunkTrust

you can't directly forward the search results from search head to 3rd party servers.

you can do it directly from Heavy forwarder/Indexer to 3rd syslog server.

https://docs.splunk.com/Documentation/Splunk/8.0.6/Search/Forwarddatatothirdpartysystems#:~:text=To%....

————————————
If this helps, give a like below.
0 Karma

thambisetty
SplunkTrust
SplunkTrust

I don't know what is your case. you can do using below procedure:

  1. create your search and write your results to csv file using outputcsv command.
  2. create inputs.conf to monitor the file and create outputs.conf to forward data using [syslog] on search head.
————————————
If this helps, give a like below.

potnuru
Path Finder

@thambisetty We need to forward the raw data from Splunk to CyberArk PTA(3rd Party) tool.

We need to forward the data through SYSLOG TCP. (PTA will listen to SYSLOG TCP on xyz port).

Is there any option to forward the data from Search Head without saving it locally?

 

 

0 Karma
Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...