using splunk heavyforwarder to forward to syslog only not forwarding to index

[dwart]

log sources coming in from UniversalForwarderto Heavyforwarder looking to selectively forward to syslog without indexing on the heavyforwarder or index cluster, these selective logs need to only forward to syslog central logging system only

syslog output is working already on the heavyforwarder and indexing on the heavyforwarder is disabled, but events are being indexed on the index host/cluster, is there a configuration/deployment where HeavyForwarder selectively only forwarded to syslog without any indexing ?

[isoutamo]

Hi

here is instructions how to forward data to external syslog server: https://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Forwarddatatothird-partysystemsd#Sysl...

You just need to add selection which events you want to send to syslog and which to splunk. Also that is described in above document.

r. Ismo