Splunk Add-on for Linux: How to send add-on data to separate server

[marytwood]

I'm running the Add-on for Linux with Enterprise and would like to send the Add-on data to a separate server from the Enterprise data. How is this done?

[diogofgm]

You can forward data from splunk to other systems. Follow the steps in the docs:

If the destination is a 3rd party system:
https://docs.splunk.com/Documentation/Splunk/7.3.0/Forwarding/Forwarddatatothird-partysystemsd

If the destination is another splunk instance:
https://docs.splunk.com/Documentation/Splunk/7.3.0/Forwarding/Configureanintermediateforwarder