https://community.splunk.com/t5/Getting-Data-In/UDP-routing-on-indexer/m-p/177667#M35590 <P>yes this is doable <BR /> sendCookedData = false in outputs.conf and also see this for more information <A href="http://docs.splunk.com/Documentation/Splunk/6.2.1/Forwarding/Forwarddatatothird-partysystemsd">http://docs.splunk.com/Documentation/Splunk/6.2.1/Forwarding/Forwarddatatothird-partysystemsd</A></P> Wed, 07 Jan 2015 09:12:30 GMT kml_uvce 2015-01-07T09:12:30Z https://community.splunk.com/t5/Getting-Data-In/UDP-routing-on-indexer/m-p/177666#M35589 <P>Hi All ,</P> <P>One of our clients wats to use single Splunk instance (indexer) for both receiving and sending data.<BR /> They receiving syslog data on port 9997. The next step suppose be routing this data to external system (SIEM).<BR /> I've tried to configure routing from indexer to check the issue,but without any success:</P> <P>props.conf:<BR /> [udp_oag_xml]<BR /> MAX_EVENTS =<BR /> NO_BINARY_CHECK = true<BR /> category = Custom<BR /> description = udp_oag_xml<BR /> disabled = false<BR /> maxDist =<BR /> pulldown_type = true</P> <P>[source::udp:514]<BR /> TRANSFORMS-udp = send_to_syslog</P> <P>transforms.conf:</P> <P>[send_to_syslog]<BR /> REGEX = .<BR /> DEST_KEY=_SYSLOG_ROUTING<BR /> FORMAT=my_syslog_group</P> <P>outputs.conf:<BR /> [syslog:my_syslog_group]<BR /> server = x.x.x.x:514<BR /> type = udp<BR /> priority = NO_PRI</P> <P>If it's doable ,I would like to know how.</P> <P>Regards,<BR /> Dmitry</P> Mon, 28 Sep 2020 18:36:05 GMT https://community.splunk.com/t5/Getting-Data-In/UDP-routing-on-indexer/m-p/177666#M35589 dimitryz 2020-09-28T18:36:05Z https://community.splunk.com/t5/Getting-Data-In/UDP-routing-on-indexer/m-p/177667#M35590 <P>yes this is doable <BR /> sendCookedData = false in outputs.conf and also see this for more information <A href="http://docs.splunk.com/Documentation/Splunk/6.2.1/Forwarding/Forwarddatatothird-partysystemsd">http://docs.splunk.com/Documentation/Splunk/6.2.1/Forwarding/Forwarddatatothird-partysystemsd</A></P> Wed, 07 Jan 2015 09:12:30 GMT https://community.splunk.com/t5/Getting-Data-In/UDP-routing-on-indexer/m-p/177667#M35590 kml_uvce 2015-01-07T09:12:30Z