topic Re: using splunk heavyforwarder to forward to syslog only not forwarding to index in Getting Data In https://community.splunk.com/t5/Getting-Data-In/using-splunk-heavyforwarder-to-forward-to-syslog-only-not/m-p/574378#M101543 <P>Hi</P><P>here is instructions how to forward data to external syslog server:&nbsp;<A href="https://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Forwarddatatothird-partysystemsd#Syslog_data" target="_blank">https://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Forwarddatatothird-partysystemsd#Syslog_data</A></P><P>You just need to add selection which events you want to send to syslog and which to splunk. Also that is described in above document.</P><P>r. Ismo</P> Wed, 10 Nov 2021 10:09:26 GMT isoutamo 2021-11-10T10:09:26Z using splunk heavyforwarder to forward to syslog only not forwarding to index https://community.splunk.com/t5/Getting-Data-In/using-splunk-heavyforwarder-to-forward-to-syslog-only-not/m-p/574368#M101542 <P>log sources coming in from UniversalForwarderto Heavyforwarder looking to selectively forward to syslog without indexing on the heavyforwarder or index cluster, these selective logs need to only forward to syslog central logging system only</P><P>syslog output is working already on the heavyforwarder and indexing on the heavyforwarder is disabled, but events are being indexed on the index host/cluster, is there a configuration/deployment where HeavyForwarder selectively only forwarded to syslog without any indexing ?</P><P>&nbsp;</P><P>&nbsp;</P> Wed, 10 Nov 2021 09:43:56 GMT https://community.splunk.com/t5/Getting-Data-In/using-splunk-heavyforwarder-to-forward-to-syslog-only-not/m-p/574368#M101542 dwart 2021-11-10T09:43:56Z Re: using splunk heavyforwarder to forward to syslog only not forwarding to index https://community.splunk.com/t5/Getting-Data-In/using-splunk-heavyforwarder-to-forward-to-syslog-only-not/m-p/574378#M101543 <P>Hi</P><P>here is instructions how to forward data to external syslog server:&nbsp;<A href="https://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Forwarddatatothird-partysystemsd#Syslog_data" target="_blank">https://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Forwarddatatothird-partysystemsd#Syslog_data</A></P><P>You just need to add selection which events you want to send to syslog and which to splunk. Also that is described in above document.</P><P>r. Ismo</P> Wed, 10 Nov 2021 10:09:26 GMT https://community.splunk.com/t5/Getting-Data-In/using-splunk-heavyforwarder-to-forward-to-syslog-only-not/m-p/574378#M101543 isoutamo 2021-11-10T10:09:26Z