Seeking Solutions for Forwarding Splunk Metadata to Third-Party Systems Over TCP/HTTP

[sudha_krish]

I want to forward logs to a third-party system over HTTP, but I found in the Splunk documentation that forwarding logs to third-party systems is typically done over TCP. I tried using TCP, but I did not receive Splunk metadata like host, sourcetype, source, and index on the third-party system.

Is it possible to forward logs with metadata to a third-party system over HTTP? If not, how can I get Splunk metadata over TCP? Can anyone suggest a solution?


@splunk @splunkent2 @Splunk9 @msplunk @splunk0 

[PickleRick]

See my response in your other thread.

[livehybrid]

Hi @sudha_krish 

Sending out over HTTP does not use an open HTTP standard/API - it uses Splunk2Splunk protocol wrapped in HTTP, so therefore it is only supported for sending to other Splunk systems. 

If you want to send data to a non-Splunk system you can look at the syslog forwarding, however this sends the raw events before they are parsed.

For more information on sending to external systems please check out https://docs.splunk.com/Documentation/SplunkCloud/latest/Forwarding/Forwarddatatothird-partysystemsd

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

[kiran_panchavat]

@sudha_krish 

Splunk forwarders (Universal or Heavy) send only raw event data to non-Splunk systems over TCP or syslog by default, as outlined in the Splunk documentation. Metadata such as host, sourcetype, source, and index is internal to Splunk and not included in the raw event payload. 

To forward logs with metadata over HTTP reliably, tools like Cribl Stream are commonly used. These tools can intercept Splunk data, enrich it with metadata, and send it to third-party systems via HTTP. 

Cribl (https://cribl.io/) allows you to route events to multiple systems but maintain full metadata. In addition, you can be very selective about what goes where and you can reshape and enrich events as they're moving.