Forward search output to Syslog server

[yanivamram]

Hi All,

I wonder if we could forward a search result output to syslog server?
Something like:
earliest=-1h sourcetype=mysourcetype |

Or else, maybe I could define that whenever Splunk server receive the specific sourcetype data, it will forward it ALSO to a syslog server.

The issue is that I must keep the data on Splunk and can't put a Syslog server in front of the Splunk server.

Thanks in advance!

[somesoni2]

Follow procedure from below link to setup data cloning at your forwarder level (heavy forwarder or universal forwarder whichever you're using), so that the forwarder will send a copy of data for a sourcetype to your indexer and another to your syslog or any third party system (both targets should be specified in outputs.conf and use the FORMAT attribute to specify both targets in comma separated listed)

http://docs.splunk.com/Documentation/Splunk/7.1.1/Forwarding/Routeandfilterdatad#Configure_routing

[pruthvikrishnap]

Hi Yani,

I am not sure if we can send an output result to syslog server, but we can forward whenever Splunk server receive the specific sourcetype data.
You will have to mention the syslog server details in outputs.conf, please find the further details in doc below.

https://docs.splunk.com/Documentation/Splunk/7.1.1/Forwarding/Forwarddatatothird-partysystemsd

Let me know if this helps.