Splunk Enterprise

Splunk standalone forward data from 1 index to syslog

mpuchalski
Loves-to-Learn

I have a single instance small splunk system.  I'm receiving data for a handful of apps on this system.  I have data in 1 index on the system that I want to also send to an external syslog server (while keeping the data in Splunk).  

I have read https://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Forwarddatatothird-partysystemsd#Sysl... but that doesn't seem to indicate how to filter out a single index, and it looks like a heavy forwarder is required?  Can this work with a single-instance setup?

Labels (2)
0 Karma
Get Updates on the Splunk Community!

Machine Learning - Assisted Adaptive Thresholding

Let’s talk thresholding. Have you set up static thresholds? Tired of static thresholds triggering false ...

Observability Unlocked: Kubernetes Monitoring with Splunk Observability Cloud

  Ready to master Kubernetes and cloud monitoring like the pros?Join Splunk’s Growth Engineering team for an ...

Wrapping Up Cybersecurity Awareness Month

October might be wrapping up, but for Splunk Education, cybersecurity awareness never goes out of season. ...