Anyone know how to configure the Cisco Umbrella Add-on to also send the Umbrella logs to a syslog server?  I've tried the info here (https://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Forwarddatatothird-partysystemsd#Syslog_data) but I seem to get all data coming into my splunk system, not just the Umbrella logs. I'm wondering if there's a way to make it work for only the Umbrella data. Thanks! ... View more

I have a single instance small splunk system.  I'm receiving data for a handful of apps on this system.  I have data in 1 index on the system that I want to also send to an external syslog server (while keeping the data in Splunk).   I have read https://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Forwarddatatothird-partysystemsd#Syslog_data but that doesn't seem to indicate how to filter out a single index, and it looks like a heavy forwarder is required?  Can this work with a single-instance setup? ... View more

We have a relatively small Splunk implementation - just 1 standalone server. We're downloading Cisco Umbrella logs from the Cisco-managed S3 Bucket for reporting purposes. We now have the need to also forward those umbrella logs to a syslog server in addition to leaving them on the standalone for reporting. Is there a way to configure a standalone to forward to a syslog server? ... View more