Can I forward logs from a Heavy Forwarder in JSON format to another data capture device?

[robnewman666]

I wanted to ask if it was easy or possible to forward logs if some may be in text format from a HF to another device and send in JSON format?

[richgalloway · Accepted solution]

Splunk supports forwarding data in raw form or in syslog form, but not JSON.  See https://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Forwarddatatothird-partysystemsd

Go to https://ideas.splunk.com to suggest they support JSON.

[robnewman666]

Thanks very much. 🙂