Getting Data In

Splunk integration with other tool

splkadmin
Explorer

Hello 

I am having a single instance of Splunk enterprise on my environment ,Is there a way to forward the Splunk data to other SIEM product on required basis.

Could you please help us to provide the details to procedure on this.

Labels (1)
Tags (1)
0 Karma
1 Solution

scelikok
Champion

Hi @splkadmin,

You can see options sending data to third parties on below document.

https://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Forwarddatatothird-partysystemsd

 

If this reply helps you an upvote is appreciated.

If this reply helps you an upvote is appreciated.

View solution in original post

0 Karma

scelikok
Champion

Universal Forwarders can send data only to another Splunk instances. You should setup outputs.conf only on indexers or heavy forwarders to forward data to third party. You can select data by using host, source, sourcetype or regex based on data contents.

If this reply helps you an upvote is appreciated.
0 Karma

splkadmin
Explorer

Thank you for your reply ..

Ok I have single instance of Splunk  enterprise and installed a universal forwarder on all the client.

Now I have to sent data to third party SIEM systems..

Should I configure only output.conf or just add the forwarded IP on Splunk instance console ?

do we able to configure a props.conf and transforms.conf on same instance? or do I require heavy forwarder to do that.

 

0 Karma

scelikok
Champion

You can use single-instance Splunk Enterprise to forward data using methods/samples provided in the document. You do not need to have a heavy forwarder.

You need to configure outputs.conf and also props.conf, transforms.conf in order to route data.

If this reply helps you an upvote is appreciated.
0 Karma

scelikok
Champion

Hi @splkadmin,

You can see options sending data to third parties on below document.

https://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Forwarddatatothird-partysystemsd

 

If this reply helps you an upvote is appreciated.

If this reply helps you an upvote is appreciated.

View solution in original post

0 Karma

splkadmin
Explorer

In that case do we need to add the output.conf  on each client server that i have installed a universal forwarder or should I add only to the Splunk enterprise instance that suppose to forward the all client logs to the third party server.

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!