https://community.splunk.com/t5/Getting-Data-In/Replicate-a-subset-of-data-to-a-third-party-system-for-specific/m-p/441206#M95461 <P>Hi team </P> <P>i need to foward a copy data from specific index to third-party system, someone knows how i can do that</P> <P>regards</P> Thu, 14 Mar 2019 23:00:23 GMT evinasco 2019-03-14T23:00:23Z https://community.splunk.com/t5/Getting-Data-In/Replicate-a-subset-of-data-to-a-third-party-system-for-specific/m-p/441206#M95461 <P>Hi team </P> <P>i need to foward a copy data from specific index to third-party system, someone knows how i can do that</P> <P>regards</P> Thu, 14 Mar 2019 23:00:23 GMT https://community.splunk.com/t5/Getting-Data-In/Replicate-a-subset-of-data-to-a-third-party-system-for-specific/m-p/441206#M95461 evinasco 2019-03-14T23:00:23Z https://community.splunk.com/t5/Getting-Data-In/Replicate-a-subset-of-data-to-a-third-party-system-for-specific/m-p/441207#M95462 <P>Hi evinasco,</P> <P>Have a look at the docs here <A href="https://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Routeandfilterdatad#Replicate_a_subset_of_data_to_a_third-party_system">https://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Routeandfilterdatad#Replicate_a_subset_of_data_to_a_third-party_system</A></P> <P>Please note, that this setting is only configurable based on <CODE>host</CODE>, <CODE>source</CODE> or <CODE>sourcetype</CODE> but NOT on index.</P> <P>Hope this helps ...</P> <P>cheers, MuS</P> Thu, 14 Mar 2019 23:52:36 GMT https://community.splunk.com/t5/Getting-Data-In/Replicate-a-subset-of-data-to-a-third-party-system-for-specific/m-p/441207#M95462 MuS 2019-03-14T23:52:36Z https://community.splunk.com/t5/Getting-Data-In/Replicate-a-subset-of-data-to-a-third-party-system-for-specific/m-p/441208#M95463 <P>Hi @MuS, Do you know if this configuration shall do in the transforms.conf?</P> <PRE><CODE>[routeAll] REGEX=(.) DEST_KEY=_TCP_ROUTING FORMAT=Everything [routeSubset] REGEX=(sourcetype1|sourcetype2|sourcetype3) DEST_KEY=_TCP_ROUTING FORMAT=Subsidiary,Everything </CODE></PRE> <P>regadrs</P> Fri, 15 Mar 2019 18:20:10 GMT https://community.splunk.com/t5/Getting-Data-In/Replicate-a-subset-of-data-to-a-third-party-system-for-specific/m-p/441208#M95463 evinasco 2019-03-15T18:20:10Z https://community.splunk.com/t5/Getting-Data-In/Replicate-a-subset-of-data-to-a-third-party-system-for-specific/m-p/441209#M95464 <P>Actually something like this would make more sense:</P> <P><CODE>props.conf</CODE></P> <PRE><CODE>[sourcetype1] TRANSFORMS-001-Send-Subsidiary-sourcetype1 = Send-Subsidiary-sourcetype [sourcetype2] TRANSFORMS-002-Send-Subsidiary-sourcetype2 = Send-Subsidiary-sourcetype [sourcetype1] TRANSFORMS-003-Send-Subsidiary-sourcetype3 = Send-Subsidiary-sourcetype </CODE></PRE> <P><CODE>transforms.conf</CODE></P> <PRE><CODE>[Send-Subsidiary-sourcetype] DEST_KEY = _TCP_ROUTING FORMAT = Subsidiary, Everything </CODE></PRE> <P>The reason for that is if you send everything by default to one destination, there is no need to configure a transforms stanza for this and add additional parsing load for these events <span class="lia-unicode-emoji" title=":winking_face:">😉</span></P> <P>Hope that makes sense ...</P> <P>cheers, MuS</P> Sun, 17 Mar 2019 19:41:12 GMT https://community.splunk.com/t5/Getting-Data-In/Replicate-a-subset-of-data-to-a-third-party-system-for-specific/m-p/441209#M95464 MuS 2019-03-17T19:41:12Z