Splunk Enterprise

Building plug-in or connector with Splunk

revin
Splunk Employee
Splunk Employee

Hi Team,

I got few questions from Autobahn Security team who tried to connect their custom app to Splunk.

They found problem in transfering data from their platform to splunk. Here are their questions:

  1. How to get around to building a plug-in/connector that integrates the two apps?
  2. What accesses do we need from a DevOps standpoint to orchestrate this?
  3. Is  Splunk web-app also the same as Splunk enterprise?
  4. How to setup a Universal Forwarder connecting our API endpoint to Splunk enterprise app?
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Those are good questions, but without context.

1. There are a few ways to get data into Splunk and some ways to get data out of Splunk.  Which is the objective here?  What kind of data will be transferred?  At what rate?

2. This answer depends on the answers to question 1.

3. Splunk web is the GUI interface to Splunk Enterprise.

4. This answer also depends on the answers to question 1.  It's possible, however, that the UF cannot access the API at all and you will need a heavy forwarder to do the job.

---
If this reply helps you, an upvote would be appreciated.
0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!