Archive raw and/or indexed data to external syslog server

[stwong]

Hi all,

Our Splunk server is getting data through several channels, e.g. universal forwarders, TCP input (e.g. OPSEC LEA of Checkpoint data), SNMP, DB connection, etc.). We hope to make a copy of these data (either raw or indexed) to external server (e.g. syslog) for long term archiving.
We're looking for any recommended solution. Would anyone please help?

Thanks a lot.
Rgds

[gcusello · Accepted solution]

Hi stwong,

you can easily use Splunk for long term archiving ( see https://docs.splunk.com/Documentation/Splunk/7.0.0/Indexer/Setaretirementandarchivingpolicy ) you don't need to use an external system.

Anyway if you want to use a third party external system, you can forward all logs to an external system using syslogs ( see https://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Forwarddatatothird-partysystemsd ).

Bye.
Giuseppe

[stwong]

Thanks, We've to use indexAndForward=true for forwarding to third party, correct?

Thanks again.

[gcusello]

Hi stwong,
if you're satisfied by this answer, please accept or upvote it.
Bye.
Giuseppe

[stwong]

Hi Giuseppe,

Thanks. Will try it out.

/STwong

[HiroshiSatoh]

I think that you can backup and save it on a file server etc.

http://docs.splunk.com/Documentation/Splunk/7.0.0/Indexer/Backupindexeddata

[stwong]

Thanks, but we hope to forward to-be-fronzen data to external server (e.g. a syslog server) for archiving.