Getting Data In

1 Splunk server that indexes, but also duplicates raw data to 3rd party syslog

hortonew
Builder

We currently run 1 Splunk server that indexes all our data and whatnot, however there are requirements now that a 3rd party must review our logs as well.

We would like to still process logs in the same fashion on our single server, but also forward (duplicate) the raw data to another server that's running qradar.

I'm concerned with the forwarding options I'm seeing in the documentation and I'm not sure if they merely forward a log, or if you can still maintain the processing/indexing locally, yet still duplicate the log to a 3rd party.

How should I go about this process, or which documentation pages would be most beneficial to me?

Tags (2)
0 Karma
1 Solution

alacercogitatus
SplunkTrust
SplunkTrust

You can specify a tcp out via the outputs.conf. You will want to set the flags for indexAndForward=true and sendCookedData=false. The docs cover this really well. I can elaborate if needed.

http://docs.splunk.com/Documentation/Splunk/5.0/admin/outputsconf

View solution in original post

alacercogitatus
SplunkTrust
SplunkTrust

You can specify a tcp out via the outputs.conf. You will want to set the flags for indexAndForward=true and sendCookedData=false. The docs cover this really well. I can elaborate if needed.

http://docs.splunk.com/Documentation/Splunk/5.0/admin/outputsconf

hortonew
Builder

Thank you! Just knowing this is an option is more than enough help. I'll get back to you if I run into any issues.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...