Deployment Architecture

Forward search output to Syslog server

yanivamram
Path Finder

Hi All,

I wonder if we could forward a search result output to syslog server?
Something like:
earliest=-1h sourcetype=mysourcetype |

Or else, maybe I could define that whenever Splunk server receive the specific sourcetype data, it will forward it ALSO to a syslog server.

The issue is that I must keep the data on Splunk and can't put a Syslog server in front of the Splunk server.

Thanks in advance!

Tags (1)
0 Karma

somesoni2
Revered Legend

Follow procedure from below link to setup data cloning at your forwarder level (heavy forwarder or universal forwarder whichever you're using), so that the forwarder will send a copy of data for a sourcetype to your indexer and another to your syslog or any third party system (both targets should be specified in outputs.conf and use the FORMAT attribute to specify both targets in comma separated listed)

http://docs.splunk.com/Documentation/Splunk/7.1.1/Forwarding/Routeandfilterdatad#Configure_routing

0 Karma

pruthvikrishnap
Contributor

Hi Yani,

I am not sure if we can send an output result to syslog server, but we can forward whenever Splunk server receive the specific sourcetype data.
You will have to mention the syslog server details in outputs.conf, please find the further details in doc below.

https://docs.splunk.com/Documentation/Splunk/7.1.1/Forwarding/Forwarddatatothird-partysystemsd

Let me know if this helps.

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!