https://community.splunk.com/t5/Getting-Data-In/Syslog-Forward-without-indexing/m-p/385119#M95649 <P>How can I forward "windows security events" to a third party Syslog server without indexing it to the Splunk.</P> Sat, 16 Feb 2019 14:36:30 GMT Jawahir 2019-02-16T14:36:30Z https://community.splunk.com/t5/Getting-Data-In/Syslog-Forward-without-indexing/m-p/385119#M95649 <P>How can I forward "windows security events" to a third party Syslog server without indexing it to the Splunk.</P> Sat, 16 Feb 2019 14:36:30 GMT https://community.splunk.com/t5/Getting-Data-In/Syslog-Forward-without-indexing/m-p/385119#M95649 Jawahir 2019-02-16T14:36:30Z https://community.splunk.com/t5/Getting-Data-In/Syslog-Forward-without-indexing/m-p/385120#M95650 <P>Hi jawahir007,</P> <P>Take a look at the docs <A href="https://docs.splunk.com/Documentation/Splunk/7.2.4/Forwarding/Routeandfilterdatad#Replicate_a_subset_of_data_to_a_third-party_system">https://docs.splunk.com/Documentation/Splunk/7.2.4/Forwarding/Routeandfilterdatad#Replicate_a_subset_of_data_to_a_third-party_system</A> and leave out the <CODE>routeAll</CODE> in <CODE>props.conf</CODE>. Do this configuration on a heavy weight forwarder or an indexer, restart and new events will be sent to your third party system.</P> <P>Hope this helps ...</P> <P>cheers, MuS</P> Sat, 16 Feb 2019 19:31:50 GMT https://community.splunk.com/t5/Getting-Data-In/Syslog-Forward-without-indexing/m-p/385120#M95650 MuS 2019-02-16T19:31:50Z