You can't use tcpout to send to a 3rd party tool as that tool does not recognize the splunk tcp protocol. If you want to forward data to a 3rd party system you are going to have to use syslog. Here's some samples: outputs.conf [syslog:third_party] server = 10.37.7.44:4444 type= tcp maxEventSize = 38000 Note the maxEventSize - you may not need it that large. You'll also need a props.conf and transforms.conf to select what data to send: props.conf [apache] TRANSFORMS-send_syslog=to_syslog transforms.conf [to_syslog] REGEX = .* DEST_KEY = _SYSLOG_ROUTING FORMAT = third_party ... View more

The problem is this: $<<FIELD>>$ which should be this: $$<FIELD>$$ So change this: <query>|inputlookup _AADaily.csv |eval _time=strptime(Starttime,"%m/%d/%Y %H:%M:%S.%3N")|eval Start_Day = strftime(_time,"%d")|where Start_Day>=$StartDay1$ AND Start_Day<=$StartDay2$|where Cluster="N" OR Cluster!="ST" |eval app_status = Cluster . ":" . Status | chart count over host by app_status| appendcols [ |inputlookup _AADaily.csv |where Cluster="S" OR Cluster!="ST" | eval app_status = Cluster . ":" . Status | chart count over host by app_status] |addtotals fieldname=N_Total N*|addtotals fieldname=S_Total S*| eval Grand_Total=0 | foreach *Total [ eval Grand_Total = Grand_Total + $$<<FIELD>>$$ ] | addcoltotals labelfield=host label=Total|table host N:* N_Total S:* S_Total Grand_Total</query> to this: <query>|inputlookup _AADaily.csv |eval _time=strptime(Starttime,"%m/%d/%Y %H:%M:%S.%3N")|eval Start_Day = strftime(_time,"%d")|where Start_Day>=$StartDay1$ AND Start_Day<=$StartDay2$|where Cluster="N" OR Cluster!="ST" |eval app_status = Cluster . ":" . Status | chart count over host by app_status| appendcols [ |inputlookup _AADaily.csv |where Cluster="S" OR Cluster!="ST" | eval app_status = Cluster . ":" . Status | chart count over host by app_status] |addtotals fieldname=N_Total N*|addtotals fieldname=S_Total S*| eval Grand_Total=0 | foreach *Total [ eval Grand_Total = Grand_Total + $<<FIELD>>$ ] | addcoltotals labelfield=host label=Total|table host N:* N_Total S:* S_Total Grand_Total</query> ... View more