I am fairly new to Splunk. The company I work for already has Splunk universal forwarders installed on servers to pull log content out to Splunk servers to index. Now we would like to forward the same log content to a 3rd party system. Naturally we will add the following to outputs.conf:
server = "third-party host:port"
sendCookedData = false
As far as I'm concerned, in this setup, Splunk forwarders would bifurcate log content to both Splunk servers and third-party servers, like the above diagram. It is increasing outbound traffic of the log server. Is there is any suggestion to avoid that on the log server?
Would putting servers with heavy forwarders in the between servers with Splunk Forwarders and Splunk index servers help, like in the following diagram?
I am not sure if Splunk heavy forwarder would be able to convert cooked (I guess unparsed) data to uncooked. Maybe this is over-engineered. Basically we would like to forward log content to third-party servers and avoid the increase of outbound traffic of the content-generated server.
Any suggestion is appreciated. Thanks.
