Monitoring Splunk

RSA Archer Splunk Integration


I'm currently working as an archer engineer on an RSA Archer deployment at a government agency, and I am soliciting any informational knowledge regarding an integration between RSA Archer (V.5.4) and probably the latest version of splunk. Ideally, I would like to have a data feed from splunk feeding into the archer platform to allow our client to have meaningful data regarding enterprise assets and other components that are spread-out around the network. I look forward to you responses.

Tags (1)
0 Karma


Your agency's CDM provider should have a solution for this.

I'm aware of two solutions, although there may be others.

The first is have Archer make ODBC calls to Splunk for data. Each call will map to a Splunk saved search that collects the desired data.

The other is to schedule saved searches to collect data and write it to a file. Use cron (or something similar) to copy the file to a location Archer monitors.

If this reply helps you, an upvote would be appreciated.
0 Karma

Path Finder

He asked for the other way. Archer data to Splunk. Not Splunk to Archer

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...