When configuring data From Splunk to Non Splunk System, where will those logs be stored?

[jvar164]

Hi All,

We are trying to enable our splunk to pass logs to a Non Splunk System, we found out that we can configure the outputs.conf and add the below:

[tcpout]

[tcpout:fastlane]
server = <ip>:<port>
sendCookedData = false

My question is, on the receiving end where will be those logs/data be stored? Is anyone have tried this or is anyone have an idea on this.

Appreciate your help on this. Thanks!

[PickleRick]

If you send data to an external system it's that system's responsibility to handle incoming data. Splunk has nothing to do with it. How should we know where the non-Splunk system will store the data?

[gcusello]

Hi @jvar164,

did you have seen this https://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Forwarddatatothird-partysystemsd  or https://docs.splunk.com/Documentation/Splunk/8.2.6/Forwarding/Routeandfilterdatad#Replicate_a_subset... ?

Ciao.

Giuseppe