Splunk integration with other tool

[splkadmin]

Hello 

I am having a single instance of Splunk enterprise on my environment ,Is there a way to forward the Splunk data to other SIEM product on required basis.

Could you please help us to provide the details to procedure on this.

[scelikok]

Universal Forwarders can send data only to another Splunk instances. You should setup outputs.conf only on indexers or heavy forwarders to forward data to third party. You can select data by using host, source, sourcetype or regex based on data contents.

[splkadmin]

Thank you for your reply ..

Ok I have single instance of Splunk  enterprise and installed a universal forwarder on all the client.

Now I have to sent data to third party SIEM systems..

Should I configure only output.conf or just add the forwarded IP on Splunk instance console ?

do we able to configure a props.conf and transforms.conf on same instance? or do I require heavy forwarder to do that.

[scelikok]

You can use single-instance Splunk Enterprise to forward data using methods/samples provided in the document. You do not need to have a heavy forwarder.

You need to configure outputs.conf and also props.conf, transforms.conf in order to route data.

[scelikok · Accepted solution]

Hi @splkadmin,

You can see options sending data to third parties on below document.

https://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Forwarddatatothird-partysystemsd

If this reply helps you an upvote is appreciated.

[splkadmin]

In that case do we need to add the output.conf  on each client server that i have installed a universal forwarder or should I add only to the Splunk enterprise instance that suppose to forward the all client logs to the third party server.