1 Splunk server that indexes, but also duplicates raw data to 3rd party syslog

[hortonew]

We currently run 1 Splunk server that indexes all our data and whatnot, however there are requirements now that a 3rd party must review our logs as well.

We would like to still process logs in the same fashion on our single server, but also forward (duplicate) the raw data to another server that's running qradar.

I'm concerned with the forwarding options I'm seeing in the documentation and I'm not sure if they merely forward a log, or if you can still maintain the processing/indexing locally, yet still duplicate the log to a 3rd party.

How should I go about this process, or which documentation pages would be most beneficial to me?

[alacercogitatus · Accepted solution]

You can specify a tcp out via the outputs.conf. You will want to set the flags for indexAndForward=true and sendCookedData=false. The docs cover this really well. I can elaborate if needed.

http://docs.splunk.com/Documentation/Splunk/5.0/admin/outputsconf

[hortonew]

Thank you! Just knowing this is an option is more than enough help. I'll get back to you if I run into any issues.