https://community.splunk.com/t5/Splunk-Data-Stream-Processor/How-to-send-a-log-in-different-formats-to-different-siem/m-p/616458#M53 <P>How can I simultaneously read from a file by UF and send to the indexer in Splunk format and to another device in syslog format?</P> <P>&nbsp;</P> <P><SPAN class=""><SPAN class=""><SPAN class="">&nbsp;</SPAN></SPAN></SPAN></P> Tue, 11 Oct 2022 04:55:41 GMT nelabi 2022-10-11T04:55:41Z https://community.splunk.com/t5/Splunk-Data-Stream-Processor/How-to-send-a-log-in-different-formats-to-different-siem/m-p/616458#M53 <P>How can I simultaneously read from a file by UF and send to the indexer in Splunk format and to another device in syslog format?</P> <P>&nbsp;</P> <P><SPAN class=""><SPAN class=""><SPAN class="">&nbsp;</SPAN></SPAN></SPAN></P> Tue, 11 Oct 2022 04:55:41 GMT https://community.splunk.com/t5/Splunk-Data-Stream-Processor/How-to-send-a-log-in-different-formats-to-different-siem/m-p/616458#M53 nelabi 2022-10-11T04:55:41Z https://community.splunk.com/t5/Splunk-Data-Stream-Processor/How-to-send-a-log-in-different-formats-to-different-siem/m-p/616585#M54 <P>The short answer is: you can't.&nbsp; UFs don't have that capability.</P><P>You can replace the UF with an HF configured to forward data via syslog (see&nbsp;<A href="https://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Forwarddatatothird-partysystemsd#Syslog_data" target="_blank">https://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Forwarddatatothird-partysystemsd#Syslog_data</A>).&nbsp; Or you can install an intermediate HF so configured and have the UF send to the HF instead of your indexers.</P> Tue, 11 Oct 2022 00:07:58 GMT https://community.splunk.com/t5/Splunk-Data-Stream-Processor/How-to-send-a-log-in-different-formats-to-different-siem/m-p/616585#M54 richgalloway 2022-10-11T00:07:58Z