Can I replicate a subset of the data to a non-Splunk destination?

[Alan_Bradley]

I need to do the following on my forwarder:

1. Forward all data received and gathered by the forwarder to Splunk indexer
   
2. Replicate subset of the data, based on a source or sourcetype, to a 3rd party server

Can someone share a basic configuration example?

[matt · Accepted solution]

This will send a cooked data stream to the indexer (10.1.12.1:9997) and a second smaller uncooked tcp stream to the third party (10.1.12.2:1234). If you need the second stream to be syslog out then you will need to shift that work to the indexer.

props.conf

[syslog]
TRANSFORMS-routing = routeAll, routeSubset

transforms.conf

[routeAll]
REGEX=(.)
DEST_KEY=_TCP_ROUTING
FORMAT=Everything

[routeSubset]
REGEX=(SYSTEM|CONFIG|THREAT)
DEST_KEY=_TCP_ROUTING
FORMAT=Subsidiary,Everything

outputs.conf

[tcpout]
defaultGroup=nothing

[tcpout:Everything]
disabled=false
server=10.1.12.1:9997

[tcpout:Subsidiary]
disabled=false
sendCookedData=false
server=10.1.12.2:1234