https://community.splunk.com/t5/Getting-Data-In/Forwading-and-indexing-with-an-attitude/m-p/63109#M12667 <P>Hi PaulEscher</P> <P>I would do as followed: setup your universal forwarders, forwarders and indexer as needed. on the indexer you can do some masking of any data, like described <A href="http://www.splunk.com/wiki/Community:Credit_card_masking_regex">here</A>. further your indexer can forward the raw data to any 3rd party tool as written <A href="http://docs.splunk.com/Documentation/Splunk/4.2.3/Deploy/Routeandfilterdatad#Replicate_a_subset_of_data_to_a_third-party_system">here</A>. </P> <P>to answer your question: yes it can be done using the conf files and should/could be done on the indexer.</P> <P>hope this helps</P> <P>cheers</P> Wed, 24 Aug 2011 04:06:50 GMT MuS 2011-08-24T04:06:50Z https://community.splunk.com/t5/Getting-Data-In/Forwading-and-indexing-with-an-attitude/m-p/63108#M12666 <P>I need to collect windows security event logs and do two things with them.<BR /> First forward the data to another log collection tool, and secondly mask some of the data for my splunk index. Can all of this be done using conf files? And would this be better done on a heavy forwarder or the indexer or does it matter which?</P> <P>Thanks,<BR /> Paul</P> Wed, 24 Aug 2011 03:39:01 GMT https://community.splunk.com/t5/Getting-Data-In/Forwading-and-indexing-with-an-attitude/m-p/63108#M12666 PaulEscher 2011-08-24T03:39:01Z https://community.splunk.com/t5/Getting-Data-In/Forwading-and-indexing-with-an-attitude/m-p/63109#M12667 <P>Hi PaulEscher</P> <P>I would do as followed: setup your universal forwarders, forwarders and indexer as needed. on the indexer you can do some masking of any data, like described <A href="http://www.splunk.com/wiki/Community:Credit_card_masking_regex">here</A>. further your indexer can forward the raw data to any 3rd party tool as written <A href="http://docs.splunk.com/Documentation/Splunk/4.2.3/Deploy/Routeandfilterdatad#Replicate_a_subset_of_data_to_a_third-party_system">here</A>. </P> <P>to answer your question: yes it can be done using the conf files and should/could be done on the indexer.</P> <P>hope this helps</P> <P>cheers</P> Wed, 24 Aug 2011 04:06:50 GMT https://community.splunk.com/t5/Getting-Data-In/Forwading-and-indexing-with-an-attitude/m-p/63109#M12667 MuS 2011-08-24T04:06:50Z https://community.splunk.com/t5/Getting-Data-In/Forwading-and-indexing-with-an-attitude/m-p/63110#M12668 <P>Thank you MuS, you have confirmed that it can be done. I'll go back to the lab and test out a solution.</P> <P>Thanks,<BR /> Paul</P> Wed, 24 Aug 2011 04:51:56 GMT https://community.splunk.com/t5/Getting-Data-In/Forwading-and-indexing-with-an-attitude/m-p/63110#M12668 PaulEscher 2011-08-24T04:51:56Z