Hi,
I have an use case where i need to export data indexed in splunk to kafka in real time. So far based on the documentation i can see that it is possible to forward the raw events to a port.
1. Configure forwarder to send a cloned stream of incoming data to a tcp port.
2. Listen to the tcp port via a program and load the data into kafka.
Is there any other provision that will enable one to stream splunk indexed events in real time to an external component like kafka or a port . Kindly comment.
↧