I have a somewhat odd deployment idea that I am trying to leverage Splunk for in place of another off the shelf tool. We are in the process of replacing an event management tool that ingests events from multiple end devices and other tools as part of an infrastructure monitoring function. The potential issue is that the *to be* end visualization tool may not have a mechanism to ingest and normalize multiple data sources (SNMP Traps, Syslog, Email, SCOM events, other monitoring tool events).
So I'm interested to know if Splunk can sit between the various data sources, ingest, normalize and ***forward*** those alerts so that this new northbound tool could further process these events for further processing. This is a gross oversimplification however I am just curious to know if anyone has used Splunk in such a way.
If you did I'd like to hear about it.
Thanks,
Mike M
↧