topic Can i have splunk forward data to an external system? in Getting Data In

Can i have splunk forward data to an external system?

Erik_Swan — Thu, 21 Jan 2010 09:59:21 GMT

Is it possible to have splunk forward data to another 3rd party system that is expecting syslog?

Re: Can i have splunk forward data to an external system?

Erik_Swan — Thu, 21 Jan 2010 10:06:16 GMT

Yes,

Splunk can forward any RFC 3164 compliant events from any platform to a TCP/UDP based server and port, making the payload of any non-compliant data RFC 3164 compliant. You can specify any of the following:

TCP priority (combination of facility and severity)
Ability to specify regex and forward only the data that matches regex via props/transforms
Filter what is sent by source type, or other meta data, again via props/transforms.
Mandatory truncating of data to 1024 (to comply with RFC 3164)

For more info, see: http://docs.splunk.com/Documentation/Splunk/5.0/Deploy/Forwarddatatothird-partysystemsd

Re: Can i have splunk forward data to an external system?

dmenon84 — Mon, 26 Sep 2016 15:17:18 GMT

Hi,

If I forward the syslog to 3rd party system will I be able to keep the same info in my internal instance of Splunk as well?

Thanks,