Send data Splunk to Splunk using HEC

[aasabatini]

Hi All,

I would to know one information.

Do you think is possible send splunk data to another splunk instance with HEC? and how?

Thanks In advance

Alessandro

[venkatasri]

Hi @aasabatini 

The data already ingested to source splunk which needs to be exported out and ingest to target Splunk via HEC?

[aasabatini]

Hi @venkatasri 

Yes, a splunk instance forward data with HEC on another splunk instace

[venkatasri · Accepted solution]

Ok. There seems no direct out-of-the box solution. You need to customize it, if you know what logs you need to export out from source splunk write a

• Option 1 (Preferred): custom script to query source Splunk using REST API and store it in a file on host you actually query the results. Stored file can be ingested to target Splunk by installing UF on it and configure monitor
• Option 2: custom script to query the source Splunk using REST API, and continue ingest to target Splunk via HEC in a batch mode with HEC acknowledgement enabled on target Splunk. You can have additional functionality for resending logs to target Splunk in case you do not get positive acknowledgement.

Note: You will be charged for license in both Splunk instances if your license type is volume based (per GB). 

------------------------------------------------------

An upvote would be appreciated if it helps!