Getting Data In

How do I configure a heavy forwarder to send data to an indexer, but also send data as a single line to a syslog server?

Path Finder


I need to change a bit of my Splunk architecture and split the data output as follows:

  1. Forward from Heavy Forwarder to Splunk Indexer
  2. Forward from the same Heavy Forwarder to a Syslog server.

The first one is easy to do, but the problem is with the second one. My server receives events which are on multiple lines (e.g. Windows Event Logs) and I need to forward them to a syslog server as single line events as a cheaper backup.

How do I get the logs to forward "blindly" to one Splunk server while parsing them into one line and forwarding them to another non-splunk server?



0 Karma

New Member

There is a way to do this. There is a way that the original message can be copied, transform applied, and sent out to the syslog server. This way the original log in WEF format is indexed in its original state and the syslog server receives tab delim single line format. I've seen it in use, I just don't have the code.

0 Karma

Path Finder

Thanks @CletisSWRX , but this was almost 4 years ago - I no longer use Splunk - I use CyberEasy now.

0 Karma


I think your approach is only going to work with Syslog events and the extra effort of having to sylog-ize your remaining ones is probably going to be huge.

Some thoughts:

  • Use a product such as Snare in order to get those event logs via Syslog
  • Backup your raw data straight from your indexer
Get Updates on the Splunk Community!

Happy CX Day, Splunk Community!

Happy CX Day, Splunk Community! CX stands for Customer Experience, and today, October 3rd, is CX Day — a ...

Splunk Observability Cloud | Customer Survey!

If you use Splunk Observability Cloud, we invite you to share your valuable insights with us through a brief ...

.conf23 | Get Your Cybersecurity Defense Analyst Certification in Vegas

We’re excited to announce a new Splunk certification exam being released at .conf23! If you’re going to Las ...