Getting Data In

How to get rsyslog data going to two Splunk instances?

Engager

I would like to know if it is possible to have the data that is coming from the rsyslog server into two Splunk instances.

My rsyslog server is filtering all data and whatever does not get caught falls into a catch all. I would like that catch all data to go to the accpt environment.

Do anyone know how I could achieve this?

0 Karma

Splunk Employee
Splunk Employee

Check out the section titled "Filter and route event data to target groups" in this link:

https://docs.splunk.com/Documentation/Splunk/7.3.0/Forwarding/Routeandfilterdatad

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!