Getting Data In

forwarding logs to third party system

kannu
Communicator

Hello All ,

I want to check that whether Splunk forwarder agent (UF) can be use to forward collected raw data to another analytics tool other than splunk , I mean third party analytics tools .

I have read some document that we can achieve this from UF /HF . But guys can you help me in to let me know that which all others third party tools i can use to test it .

Warm Regards
Manish

0 Karma
1 Solution

vishaltaneja070
Motivator

@kannu

You can send logs to any of the tool like syslog, LogRythm or any other system.

This can be achieved with the help of Heavy forwarder or Intermediate Forwarder. Below Link will help you better:
https://docs.splunk.com/Documentation/Splunk/7.2.3/Forwarding/Forwarddatatothird-partysystemsd

View solution in original post

0 Karma

coccyx
Path Finder

As the other posters have mentioned, you can forward out syslog messages to third party systems. However, you will lose the structure of the events. All events just get merged into one bytestream and so the destination system must be responsible for parsing again, and since you have multiple message types in one stream this can be very difficult.

Cribl (https://cribl.io/) allows you to route events to multiple systems but maintain full metadata. In addition, you can be very selective about what goes where and you can reshape and enrich events as they're moving.

jianw223
Loves-to-Learn

This is an endorsement by a Cribl employee. As a previous user of Cribl, I would not recommend it.

0 Karma

coccyx
Path Finder

As the other posters have mentioned, you can forward out syslog messages to third party systems. However, you will lose the structure of the events. All events just get merged into one bytestream and so the destination system must be responsible for parsing again, and since you have multiple message types in one stream this can be very difficult.

Cribl (https://cribl.io/) allows you to route events to multiple systems but maintain full metadata. In addition, you can be very selective about what goes where and you can reshape and enrich events as they're moving.

vishaltaneja070
Motivator

@kannu

You can send logs to any of the tool like syslog, LogRythm or any other system.

This can be achieved with the help of Heavy forwarder or Intermediate Forwarder. Below Link will help you better:
https://docs.splunk.com/Documentation/Splunk/7.2.3/Forwarding/Forwarddatatothird-partysystemsd

View solution in original post

0 Karma

chrisyounger
SplunkTrust
SplunkTrust

Hi @kannu

You can forward as raw TCP or as syslog messages. here is the documentation: https://docs.splunk.com/Documentation/Splunk/7.2.3/Forwarding/Forwarddatatothird-partysystemsd hope it answers your questions.

Regards, Chris.