Is there a way to send AMQP messages from Splunk?

[eugenek]

We need to publish messages based on events in Splunk. Is there a way to get Splunk to publish events using AMQP? At the moment, best I can come up with is triggering a script from an alert and writing custom code to handle publishing of messages.

[Jeremiah · Accepted solution]

Splunk doesn't have any built-in features to send messages to AMQP.

There is a AMQP modular input, but that takes messages from AMQP and indexes them into Splunk, not the other way around.

https://splunkbase.splunk.com/apps/#/page/1/search/amqp/order/relevance

Since there isn't an option in Splunkbase, you'll need to create something yourself. In 6.3 Splunk added custom alert actions, which let you integrate your own alert responses into Splunk. Yes you'd need to write a script, and the integrate that into Splunk. Take a look at the links below. There are many examples of other types of alert actions in Splunkbase that you can use to get started.

http://docs.splunk.com/Documentation/Splunk/6.3.3/AdvancedDev/ModAlertsIntro
https://splunkbase.splunk.com/apps/#/order/relevance/search/alert%2520action