Getting Data In

How to forward indexed data to another splunk receiver?

ford1863
New Member

Now I configured server A and B with installing splunk, and index some local logs on server A. I want to forward these logs to server B, and wrote some configure files in /opt/splunk/etc/system/local.

props.conf:

[<sourcetype>]
TRANSFORMS-routing=send_to_windows

transforms.conf:
[send_to_windows]
REGEX=.
DEST_KEY=_TCP_ROUTING
FORMAT=windowsgroup

outputs.conf:
[tcpout:windowsgroup]
disable=fasle
server=x.x.x.x:x

The server A is configured as Splunk forwarder mode.The piont is there's no logs receiving on server B.

Tags (1)
0 Karma

woodcock
Esteemed Legend

This looks good; did you configure the receiving side with something like this?

[splunktcp://9997]
connection_host = dns
index = myindex
sourcetype = mysourcetype
0 Karma
Get Updates on the Splunk Community!

Data Management Digest – December 2025

Welcome to the December edition of Data Management Digest! As we continue our journey of data innovation, the ...

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...