https://community.splunk.com/t5/Getting-Data-In/1-Splunk-server-that-indexes-but-also-duplicates-raw-data-to-3rd/m-p/89982#M18663 <P>You can specify a tcp out via the outputs.conf. You will want to set the flags for indexAndForward=true and sendCookedData=false. The docs cover this really well. I can elaborate if needed. </P> <PRE><CODE><A href="http://docs.splunk.com/Documentation/Splunk/5.0/admin/outputsconf" target="test_blank">http://docs.splunk.com/Documentation/Splunk/5.0/admin/outputsconf</A> </CODE></PRE> Mon, 15 Oct 2012 14:29:26 GMT alacercogitatus 2012-10-15T14:29:26Z https://community.splunk.com/t5/Getting-Data-In/1-Splunk-server-that-indexes-but-also-duplicates-raw-data-to-3rd/m-p/89981#M18662 <P>We currently run 1 Splunk server that indexes all our data and whatnot, however there are requirements now that a 3rd party must review our logs as well.</P> <P>We would like to still process logs in the same fashion on our single server, but also forward (duplicate) the raw data to another server that's running qradar.</P> <P>I'm concerned with the forwarding options I'm seeing in the documentation and I'm not sure if they merely forward a log, or if you can still maintain the processing/indexing locally, yet still duplicate the log to a 3rd party. </P> <P>How should I go about this process, or which documentation pages would be most beneficial to me?</P> Mon, 15 Oct 2012 13:59:27 GMT https://community.splunk.com/t5/Getting-Data-In/1-Splunk-server-that-indexes-but-also-duplicates-raw-data-to-3rd/m-p/89981#M18662 hortonew 2012-10-15T13:59:27Z https://community.splunk.com/t5/Getting-Data-In/1-Splunk-server-that-indexes-but-also-duplicates-raw-data-to-3rd/m-p/89982#M18663 <P>You can specify a tcp out via the outputs.conf. You will want to set the flags for indexAndForward=true and sendCookedData=false. The docs cover this really well. I can elaborate if needed. </P> <PRE><CODE><A href="http://docs.splunk.com/Documentation/Splunk/5.0/admin/outputsconf" target="test_blank">http://docs.splunk.com/Documentation/Splunk/5.0/admin/outputsconf</A> </CODE></PRE> Mon, 15 Oct 2012 14:29:26 GMT https://community.splunk.com/t5/Getting-Data-In/1-Splunk-server-that-indexes-but-also-duplicates-raw-data-to-3rd/m-p/89982#M18663 alacercogitatus 2012-10-15T14:29:26Z https://community.splunk.com/t5/Getting-Data-In/1-Splunk-server-that-indexes-but-also-duplicates-raw-data-to-3rd/m-p/89983#M18664 <P>Thank you! Just knowing this is an option is more than enough help. I'll get back to you if I run into any issues.</P> Mon, 15 Oct 2012 15:29:23 GMT https://community.splunk.com/t5/Getting-Data-In/1-Splunk-server-that-indexes-but-also-duplicates-raw-data-to-3rd/m-p/89983#M18664 hortonew 2012-10-15T15:29:23Z