https://community.splunk.com/t5/Getting-Data-In/How-to-configure-forwarder-to-filter-and-forward-data-to-a-third/m-p/186795#M37388 <P>Hi premg,</P> <P>make sure your sourcetype matches exactly and your regex <CODE>(.)</CODE> looks strange. I assume you want to match everything ( equal to . in regex ) but your regex is matching <CODE>(.)</CODE> .. try using a single dot like . instead in transforms.conf.</P> <P>hope this helps ...</P> <P>cheers, MuS</P> Wed, 20 Aug 2014 05:59:23 GMT MuS 2014-08-20T05:59:23Z https://community.splunk.com/t5/Getting-Data-In/How-to-configure-forwarder-to-filter-and-forward-data-to-a-third/m-p/186794#M37387 <P>We need to forward data to a third party system.<BR /> I would need to forward all data with sourcetype as *_syslog to the third party system via UDP.<BR /> I need to forward data to third party system before indexing the data.</P> <P>so in heavyforwarder props.conf <BR /> [sourcetype::*_syslog]<BR /> TRANSFORMS-routingxxxx=routeToxxxxxxx</P> <P>in transforms.conf<BR /> [routeToxxxxxxx]<BR /> REGEX=(.)<BR /> DEST_KEY=_SYSLOG_ROUTING<BR /> FORMAT=outputs_xxxxxxx</P> <P>in outputs.conf<BR /> [syslog:outputs_xxxxxxx]<BR /> syslogSourceType=syslog<BR /> server=ip<BR /> type=udp</P> <P>The above setting is not sending any data to the third party system.<BR /> Please suggest is there is any error in the above configurations.</P> Mon, 28 Sep 2020 17:21:41 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-configure-forwarder-to-filter-and-forward-data-to-a-third/m-p/186794#M37387 premg 2020-09-28T17:21:41Z https://community.splunk.com/t5/Getting-Data-In/How-to-configure-forwarder-to-filter-and-forward-data-to-a-third/m-p/186795#M37388 <P>Hi premg,</P> <P>make sure your sourcetype matches exactly and your regex <CODE>(.)</CODE> looks strange. I assume you want to match everything ( equal to . in regex ) but your regex is matching <CODE>(.)</CODE> .. try using a single dot like . instead in transforms.conf.</P> <P>hope this helps ...</P> <P>cheers, MuS</P> Wed, 20 Aug 2014 05:59:23 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-configure-forwarder-to-filter-and-forward-data-to-a-third/m-p/186795#M37388 MuS 2014-08-20T05:59:23Z