Getting Data In

Is it possible to configure a Heavy Forwarder to send data to Indexers AND to a 3rd party server?

New Member

In short I have a heavy forwarder that is receiving a bunch of data from a syslog feed. The forwarder will then send the data to my indexer group specified in outputs.conf. I also want to forward a subset of this data to 3rd party application on a different server as well. Fortunately this subset of data is coming from the same host.

I have tried a configuration with props.conf and transforms.conf to route the data from this specific host. I then didn't see this subset of data on my indexers. So would it be possible to have this subset of data be filtered and routed on the Heavy forwarder to a 3rd party application and at the same time sent to an index on my indexer group?

0 Karma

Path Finder
0 Karma


I think if you create a separate monitor stanza in inputs.conf and tcpout/syslog in outputs.conf for the subset data and apply filtering on it it will work, as per the below example audit logs is indexed by splunk and on the same time sent to syslog server.


_SYSLOG_ROUTING = syslog-out1


defaultGroup = syslog-out1
disabled = false
server = x.x.x.x:514
type = tcp

Ahmed Elakwah

Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.