Dashboards & Visualizations

how to send newly added events in the data source to the client

uknwhu
Engager

hi, im new to splunk. I've been playing around with splunk-javascript api for few days. My purpose of using splunk is as a log management system, Where i want it to send any newly added events in the data-source to the client in real-time. I don't want to perform any search operation and return filtered data, but all the data in the data-source. I was able to use search 'all' and retrieve data from splunk. but i couldn't configure the splunk to send newly added log-data to the client as and when it is occurred. Can anyone help me?

0 Karma
1 Solution

Ayn
Legend

It depends a bit on what you mean by "client". You can do real-time searches in Splunk - that is, you issue a search and specify the time range to be "real-time", and Splunk will send back results to you as they come in.

I don't know if this qualifies for your scenario or if it's a requirement that Splunk will send these events to you somehow without you having to issue a search at all. If you simply want to forward events automatically like that instead, you can setup some kind of process that Splunk can send data as raw TCP to. Have a look at the docs concerning this here: http://docs.splunk.com/Documentation/Splunk/6.0.2/Forwarding/Forwarddatatothird-partysystemsd

View solution in original post

Ayn
Legend

It depends a bit on what you mean by "client". You can do real-time searches in Splunk - that is, you issue a search and specify the time range to be "real-time", and Splunk will send back results to you as they come in.

I don't know if this qualifies for your scenario or if it's a requirement that Splunk will send these events to you somehow without you having to issue a search at all. If you simply want to forward events automatically like that instead, you can setup some kind of process that Splunk can send data as raw TCP to. Have a look at the docs concerning this here: http://docs.splunk.com/Documentation/Splunk/6.0.2/Forwarding/Forwarddatatothird-partysystemsd

uknwhu
Engager

This helped. Thanks.

0 Karma

uknwhu
Engager

is it possible to listen to real-time updates in server from splunk sdk?

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...