Deployment Architecture

Forward search output to Syslog server

yanivamram
Path Finder

Hi All,

I wonder if we could forward a search result output to syslog server?
Something like:
earliest=-1h sourcetype=mysourcetype |

Or else, maybe I could define that whenever Splunk server receive the specific sourcetype data, it will forward it ALSO to a syslog server.

The issue is that I must keep the data on Splunk and can't put a Syslog server in front of the Splunk server.

Thanks in advance!

Tags (1)
0 Karma

somesoni2
Revered Legend

Follow procedure from below link to setup data cloning at your forwarder level (heavy forwarder or universal forwarder whichever you're using), so that the forwarder will send a copy of data for a sourcetype to your indexer and another to your syslog or any third party system (both targets should be specified in outputs.conf and use the FORMAT attribute to specify both targets in comma separated listed)

http://docs.splunk.com/Documentation/Splunk/7.1.1/Forwarding/Routeandfilterdatad#Configure_routing

0 Karma

pruthvikrishnap
Contributor

Hi Yani,

I am not sure if we can send an output result to syslog server, but we can forward whenever Splunk server receive the specific sourcetype data.
You will have to mention the syslog server details in outputs.conf, please find the further details in doc below.

https://docs.splunk.com/Documentation/Splunk/7.1.1/Forwarding/Forwarddatatothird-partysystemsd

Let me know if this helps.

0 Karma
Get Updates on the Splunk Community!

Platform Highlights | November 2022 Newsletter

 November 2022 Skill Up on Splunk with our New Builder Tech Talk SeriesCan you build it? Yes you can! *play ...

Splunk Education - Fast Start Program!

Welcome to Splunk Education! Splunk training programs are designed to enable you to get started quickly and ...

Five Subtly Different Ways of Adding Manual Instrumentation in Java

You can find the code of this example on GitHub here. Please feel free to star the repository to keep in ...