- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Splunk light alerts to Splunk Enterprise
Hello,
we have splunk light platform only for few systems, Is there a way to send alerts from splunk light and ingest to splunk enterprise?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content


Hi @knalla,
have you Splunk Light Free or Splunk Light?
If you have Splunk Light Free, Alerting isn't an available feature.
If you have Splunk Light, you can run an alert and send an event to Splunk Enterprise in many ways: via syslog, event in in a forwarded index or running a script.
Ciao.
Giuseppe
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Yes, alerting is available, currently email alerts are configured.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks gcusello, how can I configure syslog output for splunk light?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content


Hi @knalla,
to use syslogs, you can follow this documentation:
https://docs.splunk.com/Documentation/Splunk/8.0.1/Forwarding/Forwarddatatothird-partysystemsd#Syslo...
Otherwise, you should configure something like an alert action that sends events across via HTTP Event Collector using the TA-Send_to_HEC App ( https://splunkbase.splunk.com/app/3508/ ) and enablig HEC on Splunk Enterprise (for more infos see https://docs.splunk.com/Documentation/Splunk/8.0.1/Data/UsetheHTTPEventCollector ).
But maybe the easyest way is to send alerts to a mailbox and monitor this mailbox using the Splunk for IMAP App ( https://splunkbase.splunk.com/app/27/ ).
Ciao.
Giuseppe
