Send data from Splunk

[tonyArad]

Is it possible to use Splunk as a data storage server and build an application that will send the data contained by Splunk by REST API to another server?

[amit_saxena · Accepted solution]

Hi,

While REST API and SDK allows you to integrate Splunk with third party applications, you can also use custom scripts etc for the same if the third party application has a provision for the same.

You can use alerts feature in Splunk to call custom third party scripts / command line binary etc to pass on the search data from Splunk to third party application.

Let me know if you have any queries on this.

Regards,
Amit Saxena

[amit_saxena]

Hi Tony,

You can use any programming language of your choice ( which has capability to work with REST API calls ) and then use the REST API depending upon your requirement. For details on REST API, you can refer the Splunk REST API documentation at http://docs.splunk.com/Documentation/Splunk/latest/RESTAPI/RESTcontents .

Note : As "davecroto" has mentioned in later post, you can also use Splunk SDK available in few languages which acts like a wrapper over REST API to do the tasks thus simplifying the overall tasks.

Let me know if you have more queries on this.

Regards,
Amit Saxena

[tonyArad]

Hi Amit,
Thank you for your answer.
Can you please elaborate on the script/command needed in order to send out data? how do I configure it?
Thanks again!
Tony

[davecroto]

Yes, Integrate with third-party tools and or portals using the SDK language of your choice.

http://dev.splunk.com/view/splunk-sdk/SP-CAAADP7