https://community.splunk.com/t5/Getting-Data-In/How-to-forward-data-to-both-third-party-and-indexer-servers/m-p/266376#M51052 <P>I am fairly new to Splunk. The company I work for already has Splunk universal forwarders installed on servers to pull log content out to Splunk servers to index. Now we would like to forward the same log content to a 3rd party system. Naturally we will add the following to outputs.conf:</P> <PRE><CODE>server = "third-party host:port" sendCookedData = false </CODE></PRE> <P><span class="lia-inline-image-display-wrapper"><img src="https://community.splunk.com/t5/image/serverpage/image-id/2048i997881C60449501F/image-size/large?v=v2&amp;px=999" title="alt text" alt="alt text" /></span></P> <P>As far as I'm concerned, in this setup, Splunk forwarders would bifurcate log content to both Splunk servers and third-party servers, like the above diagram. <STRONG>It is increasing outbound traffic of the log server</STRONG>. Is there is any suggestion to avoid that on the log server?</P> <P>Would putting servers with heavy forwarders in the between servers with Splunk Forwarders and Splunk index servers help, like in the following diagram?</P> <P><span class="lia-inline-image-display-wrapper"><img src="https://community.splunk.com/t5/image/serverpage/image-id/2049i77BC18FBD7D7CE04/image-size/large?v=v2&amp;px=999" title="alt text" alt="alt text" /></span></P> <P>I am not sure if Splunk heavy forwarder would be able to convert cooked (I guess unparsed) data to uncooked. Maybe this is over-engineered. Basically we would like to forward log content to third-party servers and avoid the increase of outbound traffic of the content-generated server.</P> <P>Any suggestion is appreciated. Thanks.</P> Wed, 19 Oct 2016 22:54:06 GMT hyatt_calvin 2016-10-19T22:54:06Z https://community.splunk.com/t5/Getting-Data-In/How-to-forward-data-to-both-third-party-and-indexer-servers/m-p/266376#M51052 <P>I am fairly new to Splunk. The company I work for already has Splunk universal forwarders installed on servers to pull log content out to Splunk servers to index. Now we would like to forward the same log content to a 3rd party system. Naturally we will add the following to outputs.conf:</P> <PRE><CODE>server = "third-party host:port" sendCookedData = false </CODE></PRE> <P><span class="lia-inline-image-display-wrapper"><img src="https://community.splunk.com/t5/image/serverpage/image-id/2048i997881C60449501F/image-size/large?v=v2&amp;px=999" title="alt text" alt="alt text" /></span></P> <P>As far as I'm concerned, in this setup, Splunk forwarders would bifurcate log content to both Splunk servers and third-party servers, like the above diagram. <STRONG>It is increasing outbound traffic of the log server</STRONG>. Is there is any suggestion to avoid that on the log server?</P> <P>Would putting servers with heavy forwarders in the between servers with Splunk Forwarders and Splunk index servers help, like in the following diagram?</P> <P><span class="lia-inline-image-display-wrapper"><img src="https://community.splunk.com/t5/image/serverpage/image-id/2049i77BC18FBD7D7CE04/image-size/large?v=v2&amp;px=999" title="alt text" alt="alt text" /></span></P> <P>I am not sure if Splunk heavy forwarder would be able to convert cooked (I guess unparsed) data to uncooked. Maybe this is over-engineered. Basically we would like to forward log content to third-party servers and avoid the increase of outbound traffic of the content-generated server.</P> <P>Any suggestion is appreciated. Thanks.</P> Wed, 19 Oct 2016 22:54:06 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-forward-data-to-both-third-party-and-indexer-servers/m-p/266376#M51052 hyatt_calvin 2016-10-19T22:54:06Z https://community.splunk.com/t5/Getting-Data-In/How-to-forward-data-to-both-third-party-and-indexer-servers/m-p/266377#M51053 <P>I found this link to be useful:</P> <P><A href="https://answers.splunk.com/answers/211403/how-to-configure-inputsconf-and-outputsconf-on-the.html">https://answers.splunk.com/answers/211403/how-to-configure-inputsconf-and-outputsconf-on-the.html</A></P> Wed, 29 Mar 2017 18:12:17 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-forward-data-to-both-third-party-and-indexer-servers/m-p/266377#M51053 tyrone_osilesi7 2017-03-29T18:12:17Z