While this is a quick-and-dirty answer, it did not answer his need, nor would it answer mine. Here is my situation: I have a client who already has logstash everywhere on their system. Every box has a logstash forwarder, and they all point to the single logstash server. I want to provide a serious, and real-time "proof" that Splunk can do the job better. I don't have the luxury of installing splunk universal forwarder on every single production system in order to do this, and while a subset of them might show a bit of the power, getting everything will come much closer to being a slam dunk for the deal. I cannot imagine that I am the first person who would like to siphon off the logstash forwarder data for use in Splunk, at least temporarily. So I'm thinking that SOMEONE "out there" has figured out how to pull it off. I'm not asking for a permanent solution, just a way to pull it off for a quick demo. Once everyone is on-board, then the systematic replacement of the logstash forwarders will commence. Thanks muchly, DL ... View more