Migration of data from Splunk to ELK

[NOORULAINE]

Hi

We are trying to integrate the data which is on Splunk to ELK, Using Heavy forwarder can anyone suggest how inputs.conf can be configured so that it listens to the data which is on search head and then using outputs.conf we can send the data to ELK via stash

Thanks 

[richgalloway]

Splunk heavy forwarders (and indexers) send data to third-party services in syslog format only.  They do not (and cannot) listen to data on a search head (SHs do not have data).

Place heavy forwarders in front of your indexers to route data both to the indexers and to ELK.  See https://docs.splunk.com/Documentation/Splunk/9.2.1/Forwarding/Routeandfilterdatad#Replicate_a_subset... for more information.

Be aware that this is a bit of a Science Project.  Splunk does not make it easy to switch to a competing product.