would like to send logs from Splunk to Qradar?

[niha1318]

Hi,

got a requirement to send logs from Splunk to Qradar. I have gone through few splunk docs, but I couldn't get proper idea on how to start with this requirement. I was able to find some info from IBM knowledge center, as per documentation there is a Qradar app for splunk data forwarding. but i am not sure how it will work.

please let me know if anyone have knowledge on this?

Thanks in advance

[FrankVl]

"we wanted to export previously ingested data from splunk to qradar."

If it is a one off, you could do a search and export the events to csv (use the | fields _raw command to restrict the export to just the raw data).

That can also be automated with a saved search that exports to CSV and I guess also through the REST API.

For more information, see: https://docs.splunk.com/Documentation/Splunk/latest/Search/Exportsearchresults

[FrankVl]

Let's start with what kind of data you want to forward. Do you just want to route a copy of some of the data you ingest into splunk also to qradar? Or do you want to send the result of some search / alert / whatever to QRadar?

[niha1318]

Hi,

we have already ingested data into splunk, we got thousand's of hosts for specific IIS logs. but we don't want to send all of them, we particularly want to send 75 hosts to qradar.

[FrankVl]

But do you want to export previously ingested data from Splunk, or do you want to implement a (partial) parallel feed to both platforms?

[niha1318]

we wanted to export previously ingested data from splunk to qradar.

Thanks,