Deployment Architecture

index cluster sending all data to third party

willsy
Path Finder

Hello, 

I have an index cluster and would like to send ALL data to a non splunk third party end point. is this possible?

this is the props.conf however for an index cluster where should i configure these files? 

the second configuration is the transforms.conf

the final configuration is the outputs.conf

[syslog]
TRANSFORMS-routing = routeAl

[routeAll] REGEX=(.) DEST_KEY=_TCP_ROUTING FORMAT=Everything
[tcpout]
defaultGroup=nothing

[tcpout:Everything]
disabled=false
sendCookedData=false
server=10.1.12.1:10514

 my concern is that i actually just want to forward all of my data. is there a particular configuration needed for this? or any ideas? 

many thanks 

Willsy

0 Karma
Get Updates on the Splunk Community!

Getting Started with AIOps: Event Correlation Basics and Alert Storm Detection in ...

Getting Started with AIOps:Event Correlation Basics and Alert Storm Detection in Splunk IT Service ...

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...

What's New in Splunk Cloud Platform 9.0.2208?!

Howdy!  We are happy to share the newest updates in Splunk Cloud Platform 9.0.2208! Analysts can benefit ...