Title
#fleet
p

peanut butter

09/01/2022, 9:10 PM
is there any way to forward the osquery logs directly to spunk without files?
Kathy Satterlee

Kathy Satterlee

09/01/2022, 9:14 PM
You can use Firehose as an intermediary and forward them from there to Splunk: https://fleetdm.com/docs/using-fleet/osquery-logs#splunk
p

peanut butter

09/02/2022, 4:11 PM
firehose possible also not in the cloud?
Luke Heath

Luke Heath

09/02/2022, 4:30 PM
Without Firehose you could use the filesystem logging destination and then have a log forwarder like vector or other splunk-specific forwarder import the logs from file.
p

peanut butter

09/03/2022, 12:46 PM
ok thanks