Forwarding a copy of indexer received data to SecureWorks

[dondky]

We need to forward a copy of the data we are indexing to Cisco Secure works. We are running around ~400 Universal forwarders and two indexers

I have read http://docs.splunk.com/Documentation/Splunk/latest/Deploy/Forwarddatatothird-partysystems but it appears that to do this we would need to install heavy forwarders on each of our ~400 hosts.

Ideally we would want to forward the data from one place (or indexers). Another approach I can see happening is to install a heavy forwarder on the indexer itself and have it forward incoming data from the Universal forwarders to a third party system. Can anyone validate if this is valid conclusion?

Any advice would be helpful.

Thanks

[dondky · Accepted solution]

Hi all, looks like the only way to accomplish this is through the forwarders. Did some further reading and I don't see sending cooked data to their product as a viable solution.