https://community.splunk.com/t5/Getting-Data-In/Forwarding-a-copy-of-indexer-received-data-to-SecureWorks/m-p/71192#M14488 <P>We need to forward a copy of the data we are indexing to Cisco Secure works. We are running around ~400 Universal forwarders and two indexers</P> <P>I have read <A href="http://docs.splunk.com/Documentation/Splunk/latest/Deploy/Forwarddatatothird-partysystems">http://docs.splunk.com/Documentation/Splunk/latest/Deploy/Forwarddatatothird-partysystems</A> but it appears that to do this we would need to install heavy forwarders on each of our ~400 hosts.</P> <P>Ideally we would want to forward the data from one place (or indexers). Another approach I can see happening is to install a heavy forwarder on the indexer itself and have it forward incoming data from the Universal forwarders to a third party system. Can anyone validate if this is valid conclusion? </P> <P>Any advice would be helpful.</P> <P>Thanks</P> Fri, 21 Dec 2012 19:04:07 GMT dondky 2012-12-21T19:04:07Z https://community.splunk.com/t5/Getting-Data-In/Forwarding-a-copy-of-indexer-received-data-to-SecureWorks/m-p/71192#M14488 <P>We need to forward a copy of the data we are indexing to Cisco Secure works. We are running around ~400 Universal forwarders and two indexers</P> <P>I have read <A href="http://docs.splunk.com/Documentation/Splunk/latest/Deploy/Forwarddatatothird-partysystems">http://docs.splunk.com/Documentation/Splunk/latest/Deploy/Forwarddatatothird-partysystems</A> but it appears that to do this we would need to install heavy forwarders on each of our ~400 hosts.</P> <P>Ideally we would want to forward the data from one place (or indexers). Another approach I can see happening is to install a heavy forwarder on the indexer itself and have it forward incoming data from the Universal forwarders to a third party system. Can anyone validate if this is valid conclusion? </P> <P>Any advice would be helpful.</P> <P>Thanks</P> Fri, 21 Dec 2012 19:04:07 GMT https://community.splunk.com/t5/Getting-Data-In/Forwarding-a-copy-of-indexer-received-data-to-SecureWorks/m-p/71192#M14488 dondky 2012-12-21T19:04:07Z https://community.splunk.com/t5/Getting-Data-In/Forwarding-a-copy-of-indexer-received-data-to-SecureWorks/m-p/71193#M14489 <P>Hi all, looks like the only way to accomplish this is through the forwarders. Did some further reading and I don't see sending cooked data to their product as a viable solution. </P> Thu, 27 Dec 2012 21:27:15 GMT https://community.splunk.com/t5/Getting-Data-In/Forwarding-a-copy-of-indexer-received-data-to-SecureWorks/m-p/71193#M14489 dondky 2012-12-27T21:27:15Z