In an HEC environment, how would you copy a log stream to an external destination?

[twinspop]

We have a need to have all log data coming into an index copied off to another logging system. The index is being fed log data through an HEC endpoint directly into our indexer cluster.

Is there a "native" way to do it? Would it scale well?

My only solution right now is an API call every few minutes to grab raw events from the last X minutes. Which seems, uh, not elegant. Is there a better way?

[starcher]

See the docs.

http://docs.splunk.com/Documentation/Splunk/6.5.2/Forwarding/Forwarddatatothird-partysystemsd

[starcher]

what is the other logging system? Syslog?

[twinspop]

Syslog is an option, yes