Splunk Enterprise

Splunk light alerts to Splunk Enterprise

knalla
Path Finder

Hello,

we have splunk light platform only for few systems, Is there a way to send alerts from splunk light and ingest to splunk enterprise?

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @knalla,
have you Splunk Light Free or Splunk Light?
If you have Splunk Light Free, Alerting isn't an available feature.
If you have Splunk Light, you can run an alert and send an event to Splunk Enterprise in many ways: via syslog, event in in a forwarded index or running a script.

Ciao.
Giuseppe

knalla
Path Finder

Yes, alerting is available, currently email alerts are configured.

0 Karma

knalla
Path Finder

Thanks gcusello, how can I configure syslog output for splunk light?

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @knalla,
to use syslogs, you can follow this documentation:
https://docs.splunk.com/Documentation/Splunk/8.0.1/Forwarding/Forwarddatatothird-partysystemsd#Syslo...

Otherwise, you should configure something like an alert action that sends events across via HTTP Event Collector using the TA-Send_to_HEC App ( https://splunkbase.splunk.com/app/3508/ ) and enablig HEC on Splunk Enterprise (for more infos see https://docs.splunk.com/Documentation/Splunk/8.0.1/Data/UsetheHTTPEventCollector ).

But maybe the easyest way is to send alerts to a mailbox and monitor this mailbox using the Splunk for IMAP App ( https://splunkbase.splunk.com/app/27/ ).

Ciao.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...

The Latest Cisco Integrations With Splunk Platform!

Join us for an exciting tech talk where we’ll explore the latest integrations in Cisco + Splunk! We’ve ...

AI Adoption Hub Launch | Curated Resources to Get Started with AI in Splunk

Hey Splunk Practitioners and AI Enthusiasts! It’s no secret (or surprise) that AI is at the forefront of ...