Getting Data In

Can i have splunk forward data to an external system?

Erik_Swan
Splunk Employee
Splunk Employee

Is it possible to have splunk forward data to another 3rd party system that is expecting syslog?

Tags (1)
1 Solution

Erik_Swan
Splunk Employee
Splunk Employee

Yes,

Splunk can forward any RFC 3164 compliant events from any platform to a TCP/UDP based server and port, making the payload of any non-compliant data RFC 3164 compliant. You can specify any of the following:

  • TCP priority (combination of facility and severity)
  • Ability to specify regex and forward only the data that matches regex via props/transforms
  • Filter what is sent by source type, or other meta data, again via props/transforms.
  • Mandatory truncating of data to 1024 (to comply with RFC 3164)

For more info, see: http://docs.splunk.com/Documentation/Splunk/5.0/Deploy/Forwarddatatothird-partysystemsd

View solution in original post

Erik_Swan
Splunk Employee
Splunk Employee

Yes,

Splunk can forward any RFC 3164 compliant events from any platform to a TCP/UDP based server and port, making the payload of any non-compliant data RFC 3164 compliant. You can specify any of the following:

  • TCP priority (combination of facility and severity)
  • Ability to specify regex and forward only the data that matches regex via props/transforms
  • Filter what is sent by source type, or other meta data, again via props/transforms.
  • Mandatory truncating of data to 1024 (to comply with RFC 3164)

For more info, see: http://docs.splunk.com/Documentation/Splunk/5.0/Deploy/Forwarddatatothird-partysystemsd

dmenon84
Path Finder

Hi,

If I forward the syslog to 3rd party system will I be able to keep the same info in my internal instance of Splunk as well?

Thanks,

0 Karma
Get Updates on the Splunk Community!

.conf25 Community Recap

Hello Splunkers, And just like that, .conf25 is in the books! What an incredible few days — full of learning, ...

Splunk App Developers | .conf25 Recap & What’s Next

If you stopped by the Builder Bar at .conf25 this year, thank you! The retro tech beer garden vibes were ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...