Getting Data In

Sending Events to 3rd Party Products, e.g. ArcSight with Splunk 6

jenaugle
Explorer

Is there any app or process available in Splunk 6 to send events to 3rd Party Product, such as ArcSight. I am NOT talking about a Splunk Forwarder, I am talking about a Splunk App similar to Real-Time Output (which doesn't appear to work in Splunk 6). Any information would be appreciated.

LukeMurphey
Champion

Check out the Splunk App for CEF. Its a supported alternative to the Real-time Output App and it runs on Splunk 6. It works based on data-models; anything you can put into a data-model can be sent back out in CEF format.

jtrucks
Splunk Employee
Splunk Employee

You can add an output from a Splunk indexer in outputs.conf in a tcpout- stanza while setting the sendCookedData = false to send raw data events not processed by Splunk. This is a setting designed for use in sending to third-party systems, like ArcSight or other SIM tools.

If you want to send events after Splunk has done something to them, set up the above with sendCookedData = true or output to a file or even run a script from an alert. However, best is to have the other tool answer on the network like normal and format your Splunk output in CEF or other format as needed, then use tcpout to send the data. That is all that other app does. You could look under the hood at how that app performed the work and manually port over the parts that you need.

--
Jesse Trucks
Minister of Magic

jenaugle
Explorer

I agree that this is one approach, but it is related to forwarding existing events. The reason I am looking for something more in line with Real-Time Output is that you can effectively "generate" events to ArcSight for lookups like malware domain or ip searches in Splunk, build events to send to ArcSight and remove that lookup burden from ArcSight, as Splunk does this sort of thing more efficiently.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...