Getting Data In

How to forward data to both third party and indexer servers without increasing the outbound traffic of the source server?

hyatt_calvin
Engager

I am fairly new to Splunk. The company I work for already has Splunk universal forwarders installed on servers to pull log content out to Splunk servers to index. Now we would like to forward the same log content to a 3rd party system. Naturally we will add the following to outputs.conf:

server = "third-party host:port"
sendCookedData = false

alt text

As far as I'm concerned, in this setup, Splunk forwarders would bifurcate log content to both Splunk servers and third-party servers, like the above diagram. It is increasing outbound traffic of the log server. Is there is any suggestion to avoid that on the log server?

Would putting servers with heavy forwarders in the between servers with Splunk Forwarders and Splunk index servers help, like in the following diagram?

alt text

I am not sure if Splunk heavy forwarder would be able to convert cooked (I guess unparsed) data to uncooked. Maybe this is over-engineered. Basically we would like to forward log content to third-party servers and avoid the increase of outbound traffic of the content-generated server.

Any suggestion is appreciated. Thanks.

tyrone_osilesi7
Explorer
0 Karma
Get Updates on the Splunk Community!

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

🔐 Trust at Every Hop: How mTLS in Splunk Enterprise 10.0 Makes Security Simpler

From Idea to Implementation: Why Splunk Built mTLS into Splunk Enterprise 10.0  mTLS wasn’t just a checkbox ...

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...