Send osquery data to Splunk

[pintomi1989]

• customer-hubble: Gong snippets:
  • https://us-65885.app.gong.io/call?id=4583981446770707097&highlights=%5B%7B%22type%22%3A%22SHARE%22%2C%22from%22%3A704%2C%22to%22%3A793%7D%5D
  • https://us-65885.app.gong.io/call?id=6677962879862390166&highlights=%5B%7B%22type%22%3A%22SHARE%22%2C%22from%22%3A1279%2C%22to%22%3A1319%7D%5D
• @noahtalerman: User requested this because they want to integrate Fleet directly with Splunk without relying on AWS Firehose or other middleware. Current options add extra costs, complexity, and potential points of failure. Many enterprise tools, such as CrowdStrike and Netskope, can send data directly to Splunk, and they would like Fleet to do the same.
  • @noahtalerman: In the interim hubble is connecting Fleet to AWS Firehose and then connecting AWS Firehose to Splunk.
  • @noahtalerman: Eventually Support a native integration that allows Fleet to send logs and telemetry data directly to Splunk, eliminating the need for additional message delivery services.
    • @edwardsb: When Fleet uses Firehose, we get to offload the work to handle batch writes and intermittent failures (ex. request to Splunk fails). I think this would be a relatively large engineering lift.

---

[noahtalerman]

@pintomi1989 can you please add a Gong snippet?

Once there's a Gong snippet please add back the :product label so that we can take this request through unpacking the why: https://fleetdm.com/handbook/product-design#unpacking-the-why

[pintomi1989]

Hi @noahtalerman - Will do. customer-hubble cancelled their meeting this week, so I will have to get a sound clip during our next session

[pintomi1989]

Actually, I think this might be what you need: https://us-65885.app.gong.io/call?id=5882061031461674277&highlights=%5B%7B%22type%22%3A%22SHARE%22%2C%22from%22%3A1514%2C%22to%22%3A1563%7D%5D @noahtalerman