Building plug-in or connector with Splunk

[revin]

Hi Team,

I got few questions from Autobahn Security team who tried to connect their custom app to Splunk.

They found problem in transfering data from their platform to splunk. Here are their questions:

1. How to get around to building a plug-in/connector that integrates the two apps?
2. What accesses do we need from a DevOps standpoint to orchestrate this?
3. Is  Splunk web-app also the same as Splunk enterprise?
4. How to setup a Universal Forwarder connecting our API endpoint to Splunk enterprise app?

[richgalloway]

Those are good questions, but without context.

1. There are a few ways to get data into Splunk and some ways to get data out of Splunk.  Which is the objective here?  What kind of data will be transferred?  At what rate?

2. This answer depends on the answers to question 1.

3. Splunk web is the GUI interface to Splunk Enterprise.

4. This answer also depends on the answers to question 1.  It's possible, however, that the UF cannot access the API at all and you will need a heavy forwarder to do the job.