How can i send somes logs from splunkcloud to graylog instances ?

[ebuitweb]

Hi,

To centralize a part of our logs with another team, we need to push the result of a splunk query to a graylog instances.  i didn't find a splunk app or splunk feature to do it.

do you have an idea ?

thanks

[livehybrid]

You could look to create a custom alert action and use this to send data out Splunk.

https://docs.splunk.com/Documentation/Splunk/8.0.4/AdvancedDev/ModAlertsBasicExample

As you're on SplunkCloud you'll need to make sure that the endpoint you're sending to is SSL to pass the vetting.

Alternatively you could look at sending to Graylog's GELF via HTTP from the DBData/REST Lookup app. I think it can be configured to send a payload (e.g. the output of your search) - although I wouldnt suggest this if you have more than a handful of lines to send, but may inspire other options! https://splunkbase.splunk.com/app/4253/

[ebuitweb]

hi livehybrid,

thanks for your help, so the best solution is to create a custom alert to send data to graylog. how to be sure that all event (search result) are sent to the graylog . For example if we have a connection issues, is there a retry mechanism ? 

thanks