Getting Data In

Splunk integration with other tool

splkadmin
Explorer

Hello 

I am having a single instance of Splunk enterprise on my environment ,Is there a way to forward the Splunk data to other SIEM product on required basis.

Could you please help us to provide the details to procedure on this.

Labels (1)
Tags (1)
0 Karma
1 Solution

scelikok
SplunkTrust
SplunkTrust

Hi @splkadmin,

You can see options sending data to third parties on below document.

https://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Forwarddatatothird-partysystemsd

 

If this reply helps you an upvote is appreciated.

If this reply helps you an upvote and "Accept as Solution" is appreciated.

View solution in original post

0 Karma

scelikok
SplunkTrust
SplunkTrust

Universal Forwarders can send data only to another Splunk instances. You should setup outputs.conf only on indexers or heavy forwarders to forward data to third party. You can select data by using host, source, sourcetype or regex based on data contents.

If this reply helps you an upvote and "Accept as Solution" is appreciated.
0 Karma

splkadmin
Explorer

Thank you for your reply ..

Ok I have single instance of Splunk  enterprise and installed a universal forwarder on all the client.

Now I have to sent data to third party SIEM systems..

Should I configure only output.conf or just add the forwarded IP on Splunk instance console ?

do we able to configure a props.conf and transforms.conf on same instance? or do I require heavy forwarder to do that.

 

0 Karma

scelikok
SplunkTrust
SplunkTrust

You can use single-instance Splunk Enterprise to forward data using methods/samples provided in the document. You do not need to have a heavy forwarder.

You need to configure outputs.conf and also props.conf, transforms.conf in order to route data.

If this reply helps you an upvote and "Accept as Solution" is appreciated.
0 Karma

scelikok
SplunkTrust
SplunkTrust

Hi @splkadmin,

You can see options sending data to third parties on below document.

https://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Forwarddatatothird-partysystemsd

 

If this reply helps you an upvote is appreciated.

If this reply helps you an upvote and "Accept as Solution" is appreciated.
0 Karma

splkadmin
Explorer

In that case do we need to add the output.conf  on each client server that i have installed a universal forwarder or should I add only to the Splunk enterprise instance that suppose to forward the all client logs to the third party server.

0 Karma
Get Updates on the Splunk Community!

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...

SignalFlow: What? Why? How?

What is SignalFlow? Splunk Observability Cloud’s analytics engine, SignalFlow, opens up a world of in-depth ...

Federated Search for Amazon S3 | Key Use Cases to Streamline Compliance Workflows

Modern business operations are supported by data compliance. As regulations evolve, organizations must ...