Getting Data In
Highlighted

Can i have splunk forward data to an external system?

Splunk Employee
Splunk Employee

Is it possible to have splunk forward data to another 3rd party system that is expecting syslog?

Tags (1)
Highlighted

Re: Can i have splunk forward data to an external system?

Splunk Employee
Splunk Employee

Yes,

Splunk can forward any RFC 3164 compliant events from any platform to a TCP/UDP based server and port, making the payload of any non-compliant data RFC 3164 compliant. You can specify any of the following:

  • TCP priority (combination of facility and severity)
  • Ability to specify regex and forward only the data that matches regex via props/transforms
  • Filter what is sent by source type, or other meta data, again via props/transforms.
  • Mandatory truncating of data to 1024 (to comply with RFC 3164)

For more info, see: http://docs.splunk.com/Documentation/Splunk/5.0/Deploy/Forwarddatatothird-partysystemsd

View solution in original post

Highlighted

Re: Can i have splunk forward data to an external system?

Path Finder

Hi,

If I forward the syslog to 3rd party system will I be able to keep the same info in my internal instance of Splunk as well?

Thanks,

0 Karma