Deployment Architecture

index cluster sending all data to third party

willsy
Communicator

Hello, 

I have an index cluster and would like to send ALL data to a non splunk third party end point. is this possible?

this is the props.conf however for an index cluster where should i configure these files? 

the second configuration is the transforms.conf

the final configuration is the outputs.conf

[syslog]
TRANSFORMS-routing = routeAl

[routeAll] REGEX=(.) DEST_KEY=_TCP_ROUTING FORMAT=Everything
[tcpout]
defaultGroup=nothing

[tcpout:Everything]
disabled=false
sendCookedData=false
server=10.1.12.1:10514

 my concern is that i actually just want to forward all of my data. is there a particular configuration needed for this? or any ideas? 

many thanks 

Willsy

0 Karma
Get Updates on the Splunk Community!

Splunk App for Anomaly Detection End of Life Announcment

Q: What is happening to the Splunk App for Anomaly Detection?A: Splunk is officially announcing the ...

Aligning Observability Costs with Business Value: Practical Strategies

 Join us for an engaging Tech Talk on Aligning Observability Costs with Business Value: Practical ...

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...