I'm not sure you can use native Splunk forwarding to clone data to a MARS device. If MARS can accept the data via a TCP stream (rather than UDP) and you want to send all data to MARS than you will need to turn off 'cooked data'. (by default, The forwarder mechanism expects a Splunk server on the other end). Either way I think what you are looking for can be found at:
Is it possible otherwise, if the splunkforwarder can send syslog events to itself?? I wasnt able to configure MARS to accept tcp/udp connections on the fly with splunkforwarder....
Not sure what you're trying to accomplish. What is the SplunkForwarder collecting? Is it getting data sent to it? Or are you tailing files? What data do you want sent to MARS?
I was trying to forward syslog events collectively from Splunk Forwarder to Cisco MARS, MARS requires individually configuring all the linux boxes to MARS, where as splunk is already configured to receive these syslog messages, I was jus trying to route that data to MARS ....I guess I shouldnt be doing it there is a basic compatibitility issue between these two application/device
You can forward data to cloned targets, where targets can be either splunk instance or a device receiving TCP stream. In addition, you can also forward data to syslog target as well.
The following configuration should enable cloning as well as forwarding via syslog. Set the following in outputs.conf:
[tcpout] defaultGroup = group1, group2 # Clone data to group1 and group2 [tcpout:group1] server = indexer1:9997 [tcpout:group2] server = indexer2:9997 sendCookedData = false # Send raw TCP data(logs read by splunk) # Define syslog to send data to syslog target [syslog] defaultgroup = syslogGroup1 [syslog:syslogGroup1] server = syslogServer:514 # This prevents local indexing. To enable indexing, set index = true [indexAndForward] index = false