Sending Events to 3rd Party Products, e.g. ArcSight with Splunk 6

[jenaugle]

Is there any app or process available in Splunk 6 to send events to 3rd Party Product, such as ArcSight. I am NOT talking about a Splunk Forwarder, I am talking about a Splunk App similar to Real-Time Output (which doesn't appear to work in Splunk 6). Any information would be appreciated.

[LukeMurphey]

Check out the Splunk App for CEF. Its a supported alternative to the Real-time Output App and it runs on Splunk 6. It works based on data-models; anything you can put into a data-model can be sent back out in CEF format.

[jtrucks]

You can add an output from a Splunk indexer in outputs.conf in a tcpout- stanza while setting the sendCookedData = false to send raw data events not processed by Splunk. This is a setting designed for use in sending to third-party systems, like ArcSight or other SIM tools.

If you want to send events after Splunk has done something to them, set up the above with sendCookedData = true or output to a file or even run a script from an alert. However, best is to have the other tool answer on the network like normal and format your Splunk output in CEF or other format as needed, then use tcpout to send the data. That is all that other app does. You could look under the hood at how that app performed the work and manually port over the parts that you need.

[jenaugle]

I agree that this is one approach, but it is related to forwarding existing events. The reason I am looking for something more in line with Real-Time Output is that you can effectively "generate" events to ArcSight for lookups like malware domain or ip searches in Splunk, build events to send to ArcSight and remove that lookup burden from ArcSight, as Splunk does this sort of thing more efficiently.