Splunk Search

Is there a way to send AMQP messages from Splunk?

eugenek
Path Finder

We need to publish messages based on events in Splunk. Is there a way to get Splunk to publish events using AMQP? At the moment, best I can come up with is triggering a script from an alert and writing custom code to handle publishing of messages.

0 Karma
1 Solution

Jeremiah
Motivator

Splunk doesn't have any built-in features to send messages to AMQP.

There is a AMQP modular input, but that takes messages from AMQP and indexes them into Splunk, not the other way around.

https://splunkbase.splunk.com/apps/#/page/1/search/amqp/order/relevance

Since there isn't an option in Splunkbase, you'll need to create something yourself. In 6.3 Splunk added custom alert actions, which let you integrate your own alert responses into Splunk. Yes you'd need to write a script, and the integrate that into Splunk. Take a look at the links below. There are many examples of other types of alert actions in Splunkbase that you can use to get started.

http://docs.splunk.com/Documentation/Splunk/6.3.3/AdvancedDev/ModAlertsIntro
https://splunkbase.splunk.com/apps/#/order/relevance/search/alert%2520action

View solution in original post

Jeremiah
Motivator

Splunk doesn't have any built-in features to send messages to AMQP.

There is a AMQP modular input, but that takes messages from AMQP and indexes them into Splunk, not the other way around.

https://splunkbase.splunk.com/apps/#/page/1/search/amqp/order/relevance

Since there isn't an option in Splunkbase, you'll need to create something yourself. In 6.3 Splunk added custom alert actions, which let you integrate your own alert responses into Splunk. Yes you'd need to write a script, and the integrate that into Splunk. Take a look at the links below. There are many examples of other types of alert actions in Splunkbase that you can use to get started.

http://docs.splunk.com/Documentation/Splunk/6.3.3/AdvancedDev/ModAlertsIntro
https://splunkbase.splunk.com/apps/#/order/relevance/search/alert%2520action

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...