https://community.splunk.com/t5/Getting-Data-In/How-to-forward-an-index-to-third-party-syslog-using-heavy/m-p/238830#M46388 <P>If you have already ingested and indexed the events...why are you syslogging them at all? You already have them in Splunk, the greatest software on the planet.</P> Mon, 14 Mar 2016 14:37:38 GMT lycollicott 2016-03-14T14:37:38Z https://community.splunk.com/t5/Getting-Data-In/How-to-forward-an-index-to-third-party-syslog-using-heavy/m-p/238826#M46384 <P>I have an index <CODE>test_index</CODE> collecting <CODE>http</CODE> logs and I want to forward to another syslog server. I have <CODE>outputs.conf</CODE>, <CODE>props.conf</CODE> and <CODE>transform.conf</CODE> as such:</P> <OL> <LI><P><CODE>outputs.conf</CODE></P> <P>[syslog]<BR /> defaultGroup=syslogGroup<BR /> type=tcp</P> <P>[syslog:syslogGroup]<BR /> server = 192.168.22.101:514</P> <P>[tcpout]<BR /> defaultGroup = raw_tcp_out<BR /> forwardedindex.0.whitelist = <BR /> forwardedindex.1.blacklist = <BR /> forwardedindex.2.whitelist = <BR /> indexAndForward = true<BR /> sendCookedData = false<BR /> forwardedindex.0.whitelist = test_index</P> <P>[tcpout:raw_tcp_out]<BR /> server = 192.168.22.101:514</P></LI> <LI><P><CODE>props.conf</CODE></P> <P>[host::192.168.22.101]<BR /> TRANSFORMS-kiwi = send_to_syslog</P></LI> <LI><P><CODE>transform.conf</CODE></P> <P>[send_to_syslog]<BR /> REGEX = .<BR /> DEST_KEY = _SYSLOG_ROUTING<BR /> FORMAT = syslogGroup</P></LI> </OL> <P>When I check with the destination syslog server 192.168.22.101, it is logging a lot of events which are not from <CODE>test_index</CODE>. Is there anything wrong with config files ? I a using 6.3.3 latest Splunk heavy forwarder.<BR /> thanks</P> Tue, 29 Sep 2020 09:01:39 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-forward-an-index-to-third-party-syslog-using-heavy/m-p/238826#M46384 michael_lee 2020-09-29T09:01:39Z https://community.splunk.com/t5/Getting-Data-In/How-to-forward-an-index-to-third-party-syslog-using-heavy/m-p/238827#M46385 <P>In your outputs.conf why do you have multiple blank whitelists and blacklist?</P> <PRE><CODE>[tcpout] defaultGroup = raw_tcp_out **forwardedindex.0.whitelist = forwardedindex.1.blacklist = forwardedindex.2.whitelist =** indexAndForward = true sendCookedData = false forwardedindex.0.whitelist = test_index </CODE></PRE> Fri, 11 Mar 2016 14:40:19 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-forward-an-index-to-third-party-syslog-using-heavy/m-p/238827#M46385 ryandg 2016-03-11T14:40:19Z https://community.splunk.com/t5/Getting-Data-In/How-to-forward-an-index-to-third-party-syslog-using-heavy/m-p/238828#M46386 <P>I have added something like this. Is this correct? First, I blacklist everything that I don't need to be forwarded. Then lastly the whitelist.</P> <PRE><CODE> forwardedindex.1.blacklist = _* forwardedindex.2.blacklist = main forwardedindex.0.whitelist = my_index_to_forward </CODE></PRE> Sat, 12 Mar 2016 15:13:40 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-forward-an-index-to-third-party-syslog-using-heavy/m-p/238828#M46386 michael_lee 2016-03-12T15:13:40Z https://community.splunk.com/t5/Getting-Data-In/How-to-forward-an-index-to-third-party-syslog-using-heavy/m-p/238829#M46387 <P>try removing the blacklists and just having the whitelist. It's redundant to do a whitelist and a blacklist.</P> Mon, 14 Mar 2016 13:58:34 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-forward-an-index-to-third-party-syslog-using-heavy/m-p/238829#M46387 ryandg 2016-03-14T13:58:34Z https://community.splunk.com/t5/Getting-Data-In/How-to-forward-an-index-to-third-party-syslog-using-heavy/m-p/238830#M46388 <P>If you have already ingested and indexed the events...why are you syslogging them at all? You already have them in Splunk, the greatest software on the planet.</P> Mon, 14 Mar 2016 14:37:38 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-forward-an-index-to-third-party-syslog-using-heavy/m-p/238830#M46388 lycollicott 2016-03-14T14:37:38Z