CEF output to Arcsight - where can I find 'rtoutput.py' ?

[meno]

Where can I find rtoutput.py ? It is mentioned here on page 8.

[araitz · Accepted solution]

The framework is still being tightly controlled while it undergoes additional development - specifically, I am working on a UI for it 🙂

I will be sure to upload to Splunkbase and post a blog when it is ready for mass distribution.

[matthieu_araman]

it looks like this rtoutput.py script is no longer needed -> the functionality is now integrated into splunk cef app which allow most configuration via a web form.

[awurster]

can we have an update on this please? is it part of the real time output app?

http://splunk-base.splunk.com/apps/48082/splunk-real-time-output

[edbolton]

I'm very interested in doing this in my environment, has there been any movement on the UI/formal support?

[dmlee]

Hi araitz,

our customer also want to use splunk to monitor logs and send alert message to ArcSight, May I know the progress of your framework ? Could you please share rtoutput.py to us ? thank you.