Monitoring Splunk

RSA Archer Splunk Integration


I'm currently working as an archer engineer on an RSA Archer deployment at a government agency, and I am soliciting any informational knowledge regarding an integration between RSA Archer (V.5.4) and probably the latest version of splunk. Ideally, I would like to have a data feed from splunk feeding into the archer platform to allow our client to have meaningful data regarding enterprise assets and other components that are spread-out around the network. I look forward to you responses.

Tags (1)
0 Karma


Your agency's CDM provider should have a solution for this.

I'm aware of two solutions, although there may be others.

The first is have Archer make ODBC calls to Splunk for data. Each call will map to a Splunk saved search that collects the desired data.

The other is to schedule saved searches to collect data and write it to a file. Use cron (or something similar) to copy the file to a location Archer monitors.

If this reply helps you, an upvote would be appreciated.
0 Karma

Path Finder

He asked for the other way. Archer data to Splunk. Not Splunk to Archer

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!


Or Learn More in Our Blog >>