Getting Data In

With splunkd behind a firewall, S3 and sshfs work to access logs, but can a Splunk forwarder collect logs in redis?

92607547
New Member

Hi.

Currently, splunk indexer works behind firewall, and it must stay behind firewall. Now I am using S3 and sshfs when I need to access logs. Does splunk have solution in its toolbox that allows forwarders collect logs in redis, for example, and the indexer will connect to redis and read all these logs? Firewall is a oneway service in my case, the indexer can see forwarders and redis, but not vice versa. I just want to have one more data input except sshfs and S3.

Thank you.

0 Karma

acharlieh
Influencer

I have not used either of these solutions extensively personally so YMMV but Hunk is a solution for Splunk to query data that at rest lives in NoSQL Data Stores. (It was built for Hadoop, but supposedly could be modified for any to query from any NoSQL system). There is also DBConnect which allows you to query various RDBMS either at search time, or polling for indexing data into Splunk.

I have not seen a solution for getting data into these data stores however.

0 Karma

92607547
New Member

pablo splunk" edit the topic and I don't agree how he changed it.
I used radis just as an example. There can be anything else instead of redis. I am looking for any solution that helps me to index data pulled by indexer but not forwarded to indexer.

Now I can use script which will pull data from DB. But scripts look like workaround in this case.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...