forwarding logs to third party system

[kannu]

Hello All ,

I want to check that whether Splunk forwarder agent (UF) can be use to forward collected raw data to another analytics tool other than splunk , I mean third party analytics tools .

I have read some document that we can achieve this from UF /HF . But guys can you help me in to let me know that which all others third party tools i can use to test it .

Warm Regards
Manish

[coccyx]

As the other posters have mentioned, you can forward out syslog messages to third party systems. However, you will lose the structure of the events. All events just get merged into one bytestream and so the destination system must be responsible for parsing again, and since you have multiple message types in one stream this can be very difficult.

Cribl (https://cribl.io/) allows you to route events to multiple systems but maintain full metadata. In addition, you can be very selective about what goes where and you can reshape and enrich events as they're moving.

[jianw223]

This is an endorsement by a Cribl employee. As a previous user of Cribl, I would not recommend it.

[coccyx]

As the other posters have mentioned, you can forward out syslog messages to third party systems. However, you will lose the structure of the events. All events just get merged into one bytestream and so the destination system must be responsible for parsing again, and since you have multiple message types in one stream this can be very difficult.

Cribl (https://cribl.io/) allows you to route events to multiple systems but maintain full metadata. In addition, you can be very selective about what goes where and you can reshape and enrich events as they're moving.

[vishaltaneja070 · Accepted solution]

@kannu

You can send logs to any of the tool like syslog, LogRythm or any other system.

This can be achieved with the help of Heavy forwarder or Intermediate Forwarder. Below Link will help you better:
https://docs.splunk.com/Documentation/Splunk/7.2.3/Forwarding/Forwarddatatothird-partysystemsd

[chrisyounger]

Hi @kannu

You can forward as raw TCP or as syslog messages. here is the documentation: https://docs.splunk.com/Documentation/Splunk/7.2.3/Forwarding/Forwarddatatothird-partysystemsd hope it answers your questions.

Regards, Chris.