https://community.splunk.com/t5/Getting-Data-In/How-to-forward-data-from-a-syslog-collection-server-to-a-third/m-p/368935#M66992 <P>Yeah don't do that. Make your syslog server send data out as well as write to file. Not the UF. I don't think the UF even can do that. It takes an indexer and you can cause all sorts of pipeline queue blocking trying it.</P> Mon, 18 Sep 2017 17:25:21 GMT starcher 2017-09-18T17:25:21Z https://community.splunk.com/t5/Getting-Data-In/How-to-forward-data-from-a-syslog-collection-server-to-a-third/m-p/368932#M66989 <P>Hey everyone,</P> <P>I currently have several devices forwarding syslog data to a syslog server. All of the devices data gets written to a directory called /syslog on the syslog server (there is a separate directory for each device inside of the /syslog directory). The syslog server uses the Universal Forwarder to forward the data in the /syslog directory to my indexers. In addition, I would like to forward all of the data being forwarded/written to the /syslog directory on the syslog server to a third party collection server. What would be the best way to forward only the data being forwarded to the /syslog directory?</P> <P>Thanks in advance for any help!</P> Mon, 14 Aug 2017 18:42:22 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-forward-data-from-a-syslog-collection-server-to-a-third/m-p/368932#M66989 R_B 2017-08-14T18:42:22Z https://community.splunk.com/t5/Getting-Data-In/How-to-forward-data-from-a-syslog-collection-server-to-a-third/m-p/368933#M66990 <P>Modify your syslog configuration to also forward syslog events to your other non Splunk system.. That isn't really a Splunk forwarder issue.</P> Mon, 14 Aug 2017 18:49:27 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-forward-data-from-a-syslog-collection-server-to-a-third/m-p/368933#M66990 starcher 2017-08-14T18:49:27Z https://community.splunk.com/t5/Getting-Data-In/How-to-forward-data-from-a-syslog-collection-server-to-a-third/m-p/368934#M66991 <P>Ah sorry, I meant to ask how could I forward the data to the third party server in addition to the indexer by using the universal forwarder. In other words, how could I configure the universal forwarder to forward the data to the other server? Or really, what would be the best way to do it in this scenario? </P> Mon, 14 Aug 2017 19:53:24 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-forward-data-from-a-syslog-collection-server-to-a-third/m-p/368934#M66991 R_B 2017-08-14T19:53:24Z https://community.splunk.com/t5/Getting-Data-In/How-to-forward-data-from-a-syslog-collection-server-to-a-third/m-p/368935#M66992 <P>Yeah don't do that. Make your syslog server send data out as well as write to file. Not the UF. I don't think the UF even can do that. It takes an indexer and you can cause all sorts of pipeline queue blocking trying it.</P> Mon, 18 Sep 2017 17:25:21 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-forward-data-from-a-syslog-collection-server-to-a-third/m-p/368935#M66992 starcher 2017-09-18T17:25:21Z https://community.splunk.com/t5/Getting-Data-In/How-to-forward-data-from-a-syslog-collection-server-to-a-third/m-p/368936#M66993 <P>Ok i see, that makes sense. Thank you for your feedback!</P> Mon, 18 Sep 2017 20:33:05 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-forward-data-from-a-syslog-collection-server-to-a-third/m-p/368936#M66993 R_B 2017-09-18T20:33:05Z