Deployment Architecture

Send Forwarder data from Splunk server as arguments

kuzkuz
Explorer

Hello,

We have a deployment App (modular Powershell) used on clients using the forwarder, I'm interested in passing data from Splunk Enterprise into the clients so this data can be used by the App to take actions, run specific sections, etc..

Can we send specific data to each forwarder from the server?

For example:
1. Run actions based on the ESX CPU that the Client is hosted
2. Run some kind of validation test based on a product reported from a different data source)

Thanks!

0 Karma

kuzkuz
Explorer

For anyone else looking an answer, we implemented a set of PowerShell functions that read data from Splunk using REST API and taking the needed action based on the result

0 Karma

skoelpin
SplunkTrust
SplunkTrust

I've done something similar but used an external tool (UC4 Automic) to do this. Splunk would trigger an alert which would then kick off the workflow in Automic. If you didn't have a workflow automation tool, then you will need to script this yourself.

First setup an alert in Splunk which will send a REST call to your remote servers which would then kick off a script which can validate your conditions

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...