https://community.splunk.com/t5/Getting-Data-In/Not-able-to-Forward-syslog-data-SOURCE-netscaler-to-ThirdParty/m-p/497354#M84797 <P>Hi All,</P> <P>Not able to Forward syslog data SOURCE=netscaler to ThirdParty throught port 514. Overrided source and trying to forward to third <BR /> party server but not working. In Transforms format is two target types(One would be syslog thirdparty server and another is existing indexers) but not wokring. Pls help.</P> <P>Forward syslog data SOURCE=netscaler to ThirdParty throught port 514:-</P> <PRE><CODE>PROPS.CONF [source::/Opt/logs/*/netscaler-*.log] TRANSFORMS-nyc = TO_TP_NET TRANSFORMS.CONF [TO_TP_NET] REGEX = . DEST_KEY = _SYSLOG_ROUTING FORMAT = TP_NET_syslog_group,Existing_indexers_Target_Group_OUTPUTS.CONF OUTPUTS.CONF:- [syslog:TP_NET_syslog_group] server = Thirdpartyservername:514 </CODE></PRE> Wed, 18 Mar 2020 12:39:27 GMT rajagurup 2020-03-18T12:39:27Z https://community.splunk.com/t5/Getting-Data-In/Not-able-to-Forward-syslog-data-SOURCE-netscaler-to-ThirdParty/m-p/497354#M84797 <P>Hi All,</P> <P>Not able to Forward syslog data SOURCE=netscaler to ThirdParty throught port 514. Overrided source and trying to forward to third <BR /> party server but not working. In Transforms format is two target types(One would be syslog thirdparty server and another is existing indexers) but not wokring. Pls help.</P> <P>Forward syslog data SOURCE=netscaler to ThirdParty throught port 514:-</P> <PRE><CODE>PROPS.CONF [source::/Opt/logs/*/netscaler-*.log] TRANSFORMS-nyc = TO_TP_NET TRANSFORMS.CONF [TO_TP_NET] REGEX = . DEST_KEY = _SYSLOG_ROUTING FORMAT = TP_NET_syslog_group,Existing_indexers_Target_Group_OUTPUTS.CONF OUTPUTS.CONF:- [syslog:TP_NET_syslog_group] server = Thirdpartyservername:514 </CODE></PRE> Wed, 18 Mar 2020 12:39:27 GMT https://community.splunk.com/t5/Getting-Data-In/Not-able-to-Forward-syslog-data-SOURCE-netscaler-to-ThirdParty/m-p/497354#M84797 rajagurup 2020-03-18T12:39:27Z