Splunk Enterprise

Splunk standalone forward data from 1 index to syslog

mpuchalski
Observer

I have a single instance small splunk system.  I'm receiving data for a handful of apps on this system.  I have data in 1 index on the system that I want to also send to an external syslog server (while keeping the data in Splunk).  

I have read https://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Forwarddatatothird-partysystemsd#Sysl... but that doesn't seem to indicate how to filter out a single index, and it looks like a heavy forwarder is required?  Can this work with a single-instance setup?

Labels (2)
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...