Getting Data In

How to get rsyslog data going to two Splunk instances?

David888
Engager

I would like to know if it is possible to have the data that is coming from the rsyslog server into two Splunk instances.

My rsyslog server is filtering all data and whatever does not get caught falls into a catch all. I would like that catch all data to go to the accpt environment.

Do anyone know how I could achieve this?

0 Karma

kmorris_splunk
Splunk Employee
Splunk Employee

Check out the section titled "Filter and route event data to target groups" in this link:

https://docs.splunk.com/Documentation/Splunk/7.3.0/Forwarding/Routeandfilterdatad

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

.conf25 Global Broadcast: Don’t Miss a Moment

Hello Splunkers, .conf25 is only a click away.  Not able to make it to .conf25 in person? No worries, you can ...

Observe and Secure All Apps with Splunk

 Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What's New in Splunk Observability - August 2025

What's New We are excited to announce the latest enhancements to Splunk Observability Cloud as well as what is ...