Requirement is to send data from Splunk to PTA tool using Scheduled Search on Search Head.
The Data should be filtered on some parameters and filtered data/events are sent to PTA in regular intervals. Like Every one hours the Events should be filtered and sent to PTA.
you can't directly forward the search results from search head to 3rd party servers.
you can do it directly from Heavy forwarder/Indexer to 3rd syslog server.
I don't know what is your case. you can do using below procedure:
@thambisetty We need to forward the raw data from Splunk to CyberArk PTA(3rd Party) tool.
We need to forward the data through SYSLOG TCP. (PTA will listen to SYSLOG TCP on xyz port).
Is there any option to forward the data from Search Head without saving it locally?