Channels
android_tests
apple-silicon
arm-architecture
auditing-warroom
aws
carving
code-review
community-feeds
core
darkbytes
doorman
ebpf
eclecticiq-polylogyx-extension
extensions
file-carving
fim
fleet
fleet-dev
fleetosquery
foundation
fuzzing
general
golang
goquery
infrastructure
jobs
kolide
linen-dev
linux
macos
officehours
osctrl
plugins
process-auditing
querycon
queryhub
random
selfgroup
sql
tls
uptycs
vendor-feeds
website
windows
zeek
zentral
zercurity
Powered by
Title
p
peanut butter
09/01/2022, 9:10 PM
is there any way to forward the osquery logs directly to spunk without files?
j
Jason
09/01/2022, 9:13 PM
https://fleetdm.com/docs/using-fleet/osquery-logs#splunk
k
Kathy Satterlee
09/01/2022, 9:14 PM
You can use Firehose as an intermediary and forward them from there to Splunk:
https://fleetdm.com/docs/using-fleet/osquery-logs#splunk
p
peanut butter
09/02/2022, 4:11 PM
firehose possible also not in the cloud?
l
Luke Heath
09/02/2022, 4:30 PM
Without Firehose you could use the
filesystem
logging destination and then have a log forwarder like vector or other splunk-specific forwarder import the logs from file.
p
peanut butter
09/03/2022, 12:46 PM
ok thanks
4 Views
#fleet
Join Slack