Forward data received on a port to a third party system

[anton085]

I have a Splunk instance configured to receive data on port 9997 from 2 forwarders. If I want to configure it to forward data received on port 9997, what should I write as the stanza in props.conf?

For example, to forward data from '/var/log', you have to write:
[source::/var/log]
TRANSFORMS-routing = send_to_tcp

What should I write when the source is the port 9997?

[masonmorales · Accepted solution]

I think these docs are what you are looking for:
http://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Forwarddatatothird-partysystemsd
http://docs.splunk.com/Documentation/Splunk/6.6.1/Forwarding/Routeandfilterdatad#Filter_and_route_ev...
http://docs.splunk.com/Documentation/Splunk/6.6.1/Forwarding/Routeandfilterdatad#Replicate_a_subset_...

[kmorris_splunk]

There is a difference between the receiving port (default 9997) that a forwarder would send data to, and a listening port, say UDP 514 if you are sending syslogs to some port where Splunk is listening for that data stream. All of your data would be coming in to 9997 if it is coming from forwarders. Your source would not reflect the receiving port that the forwarders are sending data to, like it would in the UDP 514 example.

Are you trying to send any data coming from the forwarders on to another destination?

[anton085]

"Are you trying to send any data coming from the forwarders on to another destination?"

That's exactly what I want to do. Is the props.conf config different for data received on 9997 vs other ports (i.e., 514)?

[somesoni2]

Are you trying to send all data to a different destination? Cloning the data or just redirecting?

[anton085]

I am trying to send the data to a third-party system. I would like to see the configs for both cloning and redirecting.