collect grr results for analytics using ELK/ Splunk /etc.
arimb00r opened this issue · comments
what are the options for 3rd party applications ELK/ Splunk /etc to connect GRR DB for analytics, visualization, etc.
@arimb00r what type of analytics, visualization, etc. are you thinking about?
We use plaso / dfTimeWolf / TimeSketch for our needs but not sure if those match your use case(s)
We plan on adding an output plugin for Splunk some time this year. @max-vogler should know more.
Yes, as said in #757, I will open-source a Splunk OutputPlugin in the next weeks.
Generally, if you want to connect GRR to other systems, OutputPlugins are the way to go. We have existing ones for BigQuery, CSV, SQLite, and YAML. Furthermore, we support monitoring with Prometheus
awesome .....
SplunkOutputPlugin is available in HEAD and documented at Output Plugins.
when I update the file /etc/grr/server.local.yaml with the following, the GRR is not starting
Splunk.url: https://192.168.0.100:8088
Splunk.token: bb7e1f36-8d57-4d3c-8ef5-5b2de06cdee4
Please open an issue with logs including error messages and a detailed description of your setup.