Splunk Search

Is there a way to send AMQP messages from Splunk?

eugenek
Path Finder

We need to publish messages based on events in Splunk. Is there a way to get Splunk to publish events using AMQP? At the moment, best I can come up with is triggering a script from an alert and writing custom code to handle publishing of messages.

0 Karma
1 Solution

Jeremiah
Motivator

Splunk doesn't have any built-in features to send messages to AMQP.

There is a AMQP modular input, but that takes messages from AMQP and indexes them into Splunk, not the other way around.

https://splunkbase.splunk.com/apps/#/page/1/search/amqp/order/relevance

Since there isn't an option in Splunkbase, you'll need to create something yourself. In 6.3 Splunk added custom alert actions, which let you integrate your own alert responses into Splunk. Yes you'd need to write a script, and the integrate that into Splunk. Take a look at the links below. There are many examples of other types of alert actions in Splunkbase that you can use to get started.

http://docs.splunk.com/Documentation/Splunk/6.3.3/AdvancedDev/ModAlertsIntro
https://splunkbase.splunk.com/apps/#/order/relevance/search/alert%2520action

View solution in original post

Jeremiah
Motivator

Splunk doesn't have any built-in features to send messages to AMQP.

There is a AMQP modular input, but that takes messages from AMQP and indexes them into Splunk, not the other way around.

https://splunkbase.splunk.com/apps/#/page/1/search/amqp/order/relevance

Since there isn't an option in Splunkbase, you'll need to create something yourself. In 6.3 Splunk added custom alert actions, which let you integrate your own alert responses into Splunk. Yes you'd need to write a script, and the integrate that into Splunk. Take a look at the links below. There are many examples of other types of alert actions in Splunkbase that you can use to get started.

http://docs.splunk.com/Documentation/Splunk/6.3.3/AdvancedDev/ModAlertsIntro
https://splunkbase.splunk.com/apps/#/order/relevance/search/alert%2520action

Get Updates on the Splunk Community!

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...

DevSecOps: Why You Should Care and How To Get Started

 WATCH NOW In this Tech Talk we will talk about what people mean by DevSecOps and deep dive into the different ...