Good day
i Read this document regarding to the forward data to third-party systems
http://docs.splunk.com/Documentation/Splunk/latest/Deploy/Forwarddatatothird-partysystemsd#Forward_syslog_data
and my question is can i forward my created index? instead of host?
For example
props.conf
to this
[host::nyc*]
TRANSFORMS-nyc = send_to_syslog
Into this
[index::sample]
TRANSFORMS-sample = send_to_syslog
transforms.conf
[send_to_syslog]
REGEX = .
DEST_KEY = _SYSLOG_ROUTING
FORMAT = my_syslog_group
output.conf
[syslog:my_syslog_group]
server = loghost.example.com:514
In short i would like to send the contents of the index into other non-splunk systems
Regards
Cris
... View more