Forwarding events

[bosseres]

Hello everyone,

I want to forward all data from index/sourcetype to third system.

I did outputs.conf

[tcpout:fastlane]
server = ***:1468
sendCookedData = false

[syslog]
defaultGroup=syslogGroup

[syslog:syslogGroup]
server = ***:514

but it send just metrics from internal index
how can I fix it? thank you

[somesoni2]

Where (which Splunk instance) you're setting this? (UF/HF/Indexer)

[bosseres]

Indexer

[somesoni2]

Does the data come directly from UF to your indexer? I believe routing can only be configured on HF per docs (https://docs.splunk.com/Documentation/Splunk/8.2.2/Forwarding/Routeandfilterdatad#Configure_routing)