Getting Data In

Sending Events to 3rd Party Products, e.g. ArcSight with Splunk 6


Is there any app or process available in Splunk 6 to send events to 3rd Party Product, such as ArcSight. I am NOT talking about a Splunk Forwarder, I am talking about a Splunk App similar to Real-Time Output (which doesn't appear to work in Splunk 6). Any information would be appreciated.


Check out the Splunk App for CEF. Its a supported alternative to the Real-time Output App and it runs on Splunk 6. It works based on data-models; anything you can put into a data-model can be sent back out in CEF format.

Splunk Employee
Splunk Employee

You can add an output from a Splunk indexer in outputs.conf in a tcpout- stanza while setting the sendCookedData = false to send raw data events not processed by Splunk. This is a setting designed for use in sending to third-party systems, like ArcSight or other SIM tools.

If you want to send events after Splunk has done something to them, set up the above with sendCookedData = true or output to a file or even run a script from an alert. However, best is to have the other tool answer on the network like normal and format your Splunk output in CEF or other format as needed, then use tcpout to send the data. That is all that other app does. You could look under the hood at how that app performed the work and manually port over the parts that you need.

Jesse Trucks
Minister of Magic


I agree that this is one approach, but it is related to forwarding existing events. The reason I am looking for something more in line with Real-Time Output is that you can effectively "generate" events to ArcSight for lookups like malware domain or ip searches in Splunk, build events to send to ArcSight and remove that lookup burden from ArcSight, as Splunk does this sort of thing more efficiently.

0 Karma
Get Updates on the Splunk Community!

Splunk Security Content for Threat Detection & Response, Q1 Roundup

Join Principal Threat Researcher, Michael Haag, as he walks through:An introduction to the Splunk Threat ...

Splunk Life | Happy Pride Month!

Happy Pride Month, Splunk Community! 🌈 In the United States, as well as many countries around the ...

SplunkTrust | Where Are They Now - Michael Uschmann

The Background Five years ago, Splunk published several videos showcasing members of the SplunkTrust to share ...