Hi,  from splunk, how can i check what are the logs is being forwarded out to another SIEM? output.conf is configured to forward syslog, what does the syslog containing? ... View more

I'm trying to forward logs base on index to a third-party system, and at the same time, I still need to retain the logs in Splunk. I've tried adding tcpout in outputs.conf, but it only pushing all logs to the third-party system, and doesn't store logs into Splunk. Unable to search new log in Splunk. [tcpout] defaultGroup=index1   [tcpout:index1] sendCookedData=false (tried with and without this, both doesn't work) server=1.1.1.1:12468 ... View more