Can i have splunk forward data to an external system?

[Erik_Swan]

Is it possible to have splunk forward data to another 3rd party system that is expecting syslog?

[Erik_Swan · Accepted solution]

Yes,

Splunk can forward any RFC 3164 compliant events from any platform to a TCP/UDP based server and port, making the payload of any non-compliant data RFC 3164 compliant. You can specify any of the following:

• TCP priority (combination of facility and severity)
• Ability to specify regex and forward only the data that matches regex via props/transforms
• Filter what is sent by source type, or other meta data, again via props/transforms.
• Mandatory truncating of data to 1024 (to comply with RFC 3164)

For more info, see: http://docs.splunk.com/Documentation/Splunk/5.0/Deploy/Forwarddatatothird-partysystemsd

[dmenon84]

Hi,

If I forward the syslog to 3rd party system will I be able to keep the same info in my internal instance of Splunk as well?

Thanks,