We need to publish messages based on events in Splunk. Is there a way to get Splunk to publish events using AMQP? At the moment, best I can come up with is triggering a script from an alert and writing custom code to handle publishing of messages.
Splunk doesn't have any built-in features to send messages to AMQP.
There is a AMQP modular input, but that takes messages from AMQP and indexes them into Splunk, not the other way around.
https://splunkbase.splunk.com/apps/#/page/1/search/amqp/order/relevance
Since there isn't an option in Splunkbase, you'll need to create something yourself. In 6.3 Splunk added custom alert actions, which let you integrate your own alert responses into Splunk. Yes you'd need to write a script, and the integrate that into Splunk. Take a look at the links below. There are many examples of other types of alert actions in Splunkbase that you can use to get started.
http://docs.splunk.com/Documentation/Splunk/6.3.3/AdvancedDev/ModAlertsIntro
https://splunkbase.splunk.com/apps/#/order/relevance/search/alert%2520action
Splunk doesn't have any built-in features to send messages to AMQP.
There is a AMQP modular input, but that takes messages from AMQP and indexes them into Splunk, not the other way around.
https://splunkbase.splunk.com/apps/#/page/1/search/amqp/order/relevance
Since there isn't an option in Splunkbase, you'll need to create something yourself. In 6.3 Splunk added custom alert actions, which let you integrate your own alert responses into Splunk. Yes you'd need to write a script, and the integrate that into Splunk. Take a look at the links below. There are many examples of other types of alert actions in Splunkbase that you can use to get started.
http://docs.splunk.com/Documentation/Splunk/6.3.3/AdvancedDev/ModAlertsIntro
https://splunkbase.splunk.com/apps/#/order/relevance/search/alert%2520action