https://community.splunk.com/t5/Getting-Data-In/How-to-send-certain-indexed-data-to-a-syslog-server/m-p/267076#M51148 <P>You'll need to create props.conf and transforms.conf for each sourcetype OR source OR host you wish to segregate:</P> <P>Configure all your inputs (sourcetype OR source OR host ) that are populating the index named syslog1 according to this documentation:</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/6.0.3/Forwarding/Forwarddatatothird-partysystemsd#Send_a_subset_of_data_to_a_syslog_server">http://docs.splunk.com/Documentation/Splunk/6.0.3/Forwarding/Forwarddatatothird-partysystemsd#Send_a_subset_of_data_to_a_syslog_server</A></P> Mon, 23 May 2016 12:54:55 GMT jkat54 2016-05-23T12:54:55Z https://community.splunk.com/t5/Getting-Data-In/How-to-send-certain-indexed-data-to-a-syslog-server/m-p/267075#M51147 <P>I want to send indexed data to a syslog server.</P> <P>I created "syslog1", and I want to send this indexed data only to the syslog server.</P> <P>Problem is, by default, my indexer is sending "main", "syslog1", and all other indexed data to the syslog server (which is unnecessary data).</P> <P>Is there any option I can send this "syslog1" data only to syslog?</P> Mon, 23 May 2016 12:27:33 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-send-certain-indexed-data-to-a-syslog-server/m-p/267075#M51147 srisahitya_v 2016-05-23T12:27:33Z https://community.splunk.com/t5/Getting-Data-In/How-to-send-certain-indexed-data-to-a-syslog-server/m-p/267076#M51148 <P>You'll need to create props.conf and transforms.conf for each sourcetype OR source OR host you wish to segregate:</P> <P>Configure all your inputs (sourcetype OR source OR host ) that are populating the index named syslog1 according to this documentation:</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/6.0.3/Forwarding/Forwarddatatothird-partysystemsd#Send_a_subset_of_data_to_a_syslog_server">http://docs.splunk.com/Documentation/Splunk/6.0.3/Forwarding/Forwarddatatothird-partysystemsd#Send_a_subset_of_data_to_a_syslog_server</A></P> Mon, 23 May 2016 12:54:55 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-send-certain-indexed-data-to-a-syslog-server/m-p/267076#M51148 jkat54 2016-05-23T12:54:55Z