- Splunk Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Sending data from splunk to non splunk server
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I need to run the search query on splunk like
sourcetype="agent"|spath path="EID" output="EventID"|search EventID=3|table *
I am getting 5 fields for EventID=3. I need to send the values of all five fields over some time range to non splunk server as csv file.
Right now I am using java for socket communication and Java SDK to interact with splunk.This is my approach. Today I was reading something about forwarders.
My question is :
1. Can forwarders do the same thing for me?
2. for accomplish my requirement, Using forwarders is better approach than socket communication or I am just getting confused?
3. If No.What kind of forwarder I can use for this.
Thanks,
Disha
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
No, it cannot. Have you looked into having this search fire an alert that would run a script to send the csv file to the other server? At my previous Splunk Admin engagement, this was done using smttrapd as the sender. A script could use your java solution -- which in itself is not a 'bad' thing. You are going to need some form of socket communication between the Splunk and non-Splunk server.
Look here for info about creating an alert that runs a script: http://docs.splunk.com/Documentation/Splunk/5.0.1/Alert/Setupalertactions#Run_a_script
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks for clearing my doubt.Socket communication is the better choice if we want to extend the functionality or service from splunk.Thanks
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
No, it cannot. Have you looked into having this search fire an alert that would run a script to send the csv file to the other server? At my previous Splunk Admin engagement, this was done using smttrapd as the sender. A script could use your java solution -- which in itself is not a 'bad' thing. You are going to need some form of socket communication between the Splunk and non-Splunk server.
Look here for info about creating an alert that runs a script: http://docs.splunk.com/Documentation/Splunk/5.0.1/Alert/Setupalertactions#Run_a_script
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thank for the reply.I read this doc. My question is I am not able to decide that universal forwarder can do the stuff for which I am using socket communication as My requirement is just to query the data and sending the result to non splunk server. Doc tell me how to execute if you choose this approch. I want to know that Should I go with this approch.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
When you say that you've read "something" about forwarders, what have you been reading? Because the docs explain what a forwarder is and does pretty well: http://docs.splunk.com/Documentation/Splunk/latest/Deploy/Introducingtheuniversalforwarder
Threat Hunting Unlocked: How to Uplevel Your Threat Hunting With the PEAK Framework ...
Splunk APM: New Product Features + Community Office Hours Recap!
Index This | Forward, I’m heavy; backward, I’m not. What am I?
