Sawmill seems to be another for-profit tool that both consumes log data and provides some kinds of reporting features. It's not surprising that getting data OUT of such systems isn't the top priority of companies like either Splunk or Flowerfire, since companies increase their perceived value by you keeping your data (and your focus) inside their system. We have our output methods in our docs but they may not leap out at you.
For our part, the exit paths you can use for data you send to Splunk are:
- Splunk cli search: you can search arbitary datasets and get the log messages on standard out
- forwarding: at the time data arrives into splunk, you can cause some subset to be forwarded as its raw text over a tcp socket to some non-splunk receiver
- syslog forwarding: you can ask splunk to transmit events in syslog format, similarly. This has limitations since syslog event format has limitations (no 500 line messages in syslog)
- exporttool: you can dump splunk index data to a set of flat files containing message text, or to a csv format showing all fields
If you need to get data from Sawmill into Splunk, it seems you'll need to ask the Sawmill folks how you can get data out of it, because I can't find it in their docs.
You have other options:
- send the data to Splunk first, and have it bounce it to sawmill
- send the data to both Splunk and Sawmill live
I prefer the latter, because it decouples the solutions and makes your overall architecture less brittle.
