Getting Data In

Can an intermediate Heavy Forwarder forward data to a third party system without indexing?

Can I forward data from the universal forwarders using an intermediate heavy weight forwarder to a third-party system without indexing?

If so, how exactly would I achieve this?

Thanks 🙂

Also, if only specific data coming from the universal forwarder needs to be routed, how to do that?

0 Karma

Splunk Employee
Splunk Employee

There are docs about Forwarding data to third-party systems in the Splunk Enterprise Forwarding Data manual, have you looked at those already?

0 Karma