Splunk Cloud Platform

Forward specific data from one Splunk instance to another Splunk instance

RSS_STT
Explorer

I have two separate Splunk cloud instance and want to forward specific set of data from one instance to another. Please suggest the approach or any app/add-on available for this purpose. 

Labels (1)
Tags (1)
0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

It's like @livehybrid said. You cannot / shouldn't try this that way.

Basically there are two options to do this depending how your data is collected and where it's created.

In SCP side you can set Federated Search in your SCP and use it to access data from another SCP stack. See more https://docs.splunk.com/Documentation/SplunkCloud/9.3.2411/FederatedSearch/fsoptions.

The second option is replicate data before you send it into SCP stack. E.g. you could set your own HFs where you can set this.

r. Ismo

0 Karma

livehybrid
Super Champion

Hi @RSS_STT 

It isnt possible to use typical data forwarding from Splunk Cloud to another system. 

The only Splunkbase apps I have seen for things like sending to HEC or external systems generally arent supported for Splunk Cloud, therefore the only other option would be to run something that uses the Search API to search the data and send it to the appropriate place.

Ultimately this is a very bad idea and not something that is supported or encouraged. 

What is your ultimate goal? Is there a reason you arent able to forward the data from source to multiple destinations, or use federated search to query the data from Splunk Cloud from your other instance?

The only other route I can think of is using Ingest Actions to send the data to S3 and then using the AWS TA to ingest this using your other Splunk instance.

🌟 Did this answer help you? If so, please consider:

  • Adding karma to show it was useful
  • Marking it as the solution if it resolved your issue
  • Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

 

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...