Getting Data In

Send data Splunk to Splunk using HEC

aasabatini
Motivator

Hi All,

I would to know one information.

Do you think is possible send splunk data to another splunk instance with HEC? and how?

Thanks In advance

Alessandro

“The answer is out there, Neo, and it’s looking for you, and it will find you if you want it to.”
Labels (1)
0 Karma
1 Solution

venkatasri
SplunkTrust
SplunkTrust

Ok. There seems no direct out-of-the box solution. You need to customize it, if you know what logs you need to export out from source splunk write a

  • Option 1 (Preferred): custom script to query source Splunk using REST API and store it in a file on host you actually query the results. Stored file can be ingested to target Splunk by installing UF on it and configure monitor
  • Option 2: custom script to query the source Splunk using REST API, and continue ingest to target Splunk via HEC in a batch mode with HEC acknowledgement enabled on target Splunk. You can have additional functionality for resending logs to target Splunk in case you do not get positive acknowledgement.

Note: You will be charged for license in both Splunk instances if your license type is volume based (per GB). 

------------------------------------------------------

An upvote would be appreciated if it helps!

View solution in original post

venkatasri
SplunkTrust
SplunkTrust

Hi @aasabatini 

The data already ingested to source splunk which needs to be exported out and ingest to target Splunk via HEC?

0 Karma

aasabatini
Motivator

Hi @venkatasri 

Yes, a splunk instance forward data with HEC on another splunk instace

“The answer is out there, Neo, and it’s looking for you, and it will find you if you want it to.”
0 Karma

venkatasri
SplunkTrust
SplunkTrust

Ok. There seems no direct out-of-the box solution. You need to customize it, if you know what logs you need to export out from source splunk write a

  • Option 1 (Preferred): custom script to query source Splunk using REST API and store it in a file on host you actually query the results. Stored file can be ingested to target Splunk by installing UF on it and configure monitor
  • Option 2: custom script to query the source Splunk using REST API, and continue ingest to target Splunk via HEC in a batch mode with HEC acknowledgement enabled on target Splunk. You can have additional functionality for resending logs to target Splunk in case you do not get positive acknowledgement.

Note: You will be charged for license in both Splunk instances if your license type is volume based (per GB). 

------------------------------------------------------

An upvote would be appreciated if it helps!

View solution in original post