How do i disable forwarding for one sourcetype

pjcable — Thu, 02 Nov 2023 06:39:10 GMT

Hi,

We need to send some security events to an external party. We also need this for our internal use.

On my test instance I've configured outputs.conf as

[tcpout]
defaultGroup = security
indexAndForward = 1

[tcpout:security]
server = localhost:9999

Which has got my events flowing to my fake external server and leaves them accessible in the internal side. However I only want to send 2 source types there. How do i filter out the rest of the events?

Re: How do i disable forwarding for one sourcetype

gcusello — Thu, 02 Nov 2023 06:59:40 GMT

Hi @pjcable,

as yu can read at https://docs.splunk.com/Documentation/Splunk/9.1.1/Forwarding/Routeandfilterdatad#Replicate_a_subset_of_data_to_a_third-party_system

to add a stanza in outputs.conf isn't enough, follow the configuration at the above link.

Ciao.

Giuseppe

topic Re: How do i disable forwarding for one sourcetype in Getting Data In

How do i disable forwarding for one sourcetype

Re: How do i disable forwarding for one sourcetype