Forwarding indexed data

[freeborn]

I know that there has been many variations of this question asked but I cannot seem to find the one that suites me.

We currently have a single indexer that receives various syslogs and UF data. Our parent company would like us to forward a subset of that data to them. (some of it by source field and some of it by host field)

I did read about sending to third party systems, but from what I took from this, you require to do his from another(separate) forwarder and not the indexer. How can I take the received data and send a subset based on certain criteria and forward it to the 3rd party?

[MuS]

Hi freeborn

An Indexer can also be at the same time a Forwarder, just follow the examples provided @docs http://docs.splunk.com/Documentation/Splunk/5.0.4/Deploy/Forwarddatatothird-partysystemsd


Change props and transforms to your needs, don't forget to restart your splunk or reload the new configs by executing the following search command

| extract reload=T

Also make sure your Indexer can reach the destination server over the network and the destination port is open and listening (don't forget Firewalls, routers and all kind of other Networking things).

Hope this helps to get you started....

cheers, MuS

[freeborn]

I followed the examples, but it ends up either sending all my data recived by uf, or it send all the data captured by syslog. I will do some further testing tonight and if it does not work I will post what I have.

[jonuwz]

you can do this on the indexer.