https://community.splunk.com/t5/Splunk-Enterprise/Forwarding-events/m-p/569542#M10214 <P>Where (which Splunk instance) you're setting this? (UF/HF/Indexer)</P> Mon, 04 Oct 2021 12:21:54 GMT somesoni2 2021-10-04T12:21:54Z https://community.splunk.com/t5/Splunk-Enterprise/Forwarding-events/m-p/569537#M10212 <P>Hello everyone,</P><P>I want to forward all data from index/sourcetype to third system.</P><P>I did outputs.conf</P><P>[tcpout:fastlane]<BR />server = ***:1468<BR />sendCookedData = false</P><P>[syslog]<BR />defaultGroup=syslogGroup</P><P>[syslog:syslogGroup]<BR />server = ***:514</P><P>&nbsp;</P><P>but it send just metrics from internal index<BR />how can I fix it? thank you</P> Mon, 04 Oct 2021 11:43:42 GMT https://community.splunk.com/t5/Splunk-Enterprise/Forwarding-events/m-p/569537#M10212 bosseres 2021-10-04T11:43:42Z https://community.splunk.com/t5/Splunk-Enterprise/Forwarding-events/m-p/569542#M10214 <P>Where (which Splunk instance) you're setting this? (UF/HF/Indexer)</P> Mon, 04 Oct 2021 12:21:54 GMT https://community.splunk.com/t5/Splunk-Enterprise/Forwarding-events/m-p/569542#M10214 somesoni2 2021-10-04T12:21:54Z https://community.splunk.com/t5/Splunk-Enterprise/Forwarding-events/m-p/569545#M10215 <P>Indexer</P> Mon, 04 Oct 2021 12:31:29 GMT https://community.splunk.com/t5/Splunk-Enterprise/Forwarding-events/m-p/569545#M10215 bosseres 2021-10-04T12:31:29Z https://community.splunk.com/t5/Splunk-Enterprise/Forwarding-events/m-p/569549#M10216 <P>Does the data come directly from UF to your indexer? I believe routing can only be configured on HF per docs (<A href="https://docs.splunk.com/Documentation/Splunk/8.2.2/Forwarding/Routeandfilterdatad#Configure_routing" target="_blank">https://docs.splunk.com/Documentation/Splunk/8.2.2/Forwarding/Routeandfilterdatad#Configure_routing</A>)</P> Mon, 04 Oct 2021 12:54:48 GMT https://community.splunk.com/t5/Splunk-Enterprise/Forwarding-events/m-p/569549#M10216 somesoni2 2021-10-04T12:54:48Z