Splunk Cloud Platform

Forward specific data from one Splunk instance to another Splunk instance

RSS_STT
Explorer

I have two separate Splunk cloud instance and want to forward specific set of data from one instance to another. Please suggest the approach or any app/add-on available for this purpose. 

Labels (1)
Tags (1)
0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

It's like @livehybrid said. You cannot / shouldn't try this that way.

Basically there are two options to do this depending how your data is collected and where it's created.

In SCP side you can set Federated Search in your SCP and use it to access data from another SCP stack. See more https://docs.splunk.com/Documentation/SplunkCloud/9.3.2411/FederatedSearch/fsoptions.

The second option is replicate data before you send it into SCP stack. E.g. you could set your own HFs where you can set this.

r. Ismo

0 Karma

livehybrid
Super Champion

Hi @RSS_STT 

It isnt possible to use typical data forwarding from Splunk Cloud to another system. 

The only Splunkbase apps I have seen for things like sending to HEC or external systems generally arent supported for Splunk Cloud, therefore the only other option would be to run something that uses the Search API to search the data and send it to the appropriate place.

Ultimately this is a very bad idea and not something that is supported or encouraged. 

What is your ultimate goal? Is there a reason you arent able to forward the data from source to multiple destinations, or use federated search to query the data from Splunk Cloud from your other instance?

The only other route I can think of is using Ingest Actions to send the data to S3 and then using the AWS TA to ingest this using your other Splunk instance.

🌟 Did this answer help you? If so, please consider:

  • Adding karma to show it was useful
  • Marking it as the solution if it resolved your issue
  • Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

 

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...