topic When configuring data From Splunk to Non Splunk System, where will those logs be stored? in Splunk Enterprise

When configuring data From Splunk to Non Splunk System, where will those logs be stored?

jvar164 — Wed, 15 Jun 2022 18:11:59 GMT

Hi All,

We are trying to enable our splunk to pass logs to a Non Splunk System, we found out that we can configure the outputs.conf and add the below:

[tcpout]

[tcpout:fastlane]
server = <ip>:<port>
sendCookedData = false

My question is, on the receiving end where will be those logs/data be stored? Is anyone have tried this or is anyone have an idea on this.

Appreciate your help on this. Thanks!

Re: From Splunk to Non Splunk System

gcusello — Wed, 15 Jun 2022 09:18:19 GMT

Hi @jvar164,

did you have seen this https://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Forwarddatatothird-partysystemsd or https://docs.splunk.com/Documentation/Splunk/8.2.6/Forwarding/Routeandfilterdatad#Replicate_a_subset_of_data_to_a_third-party_system ?

Ciao.

Giuseppe

Re: From Splunk to Non Splunk System

PickleRick — Wed, 15 Jun 2022 10:23:20 GMT

If you send data to an external system it's that system's responsibility to handle incoming data. Splunk has nothing to do with it. How should we know where the non-Splunk system will store the data?