Getting Data In

How to forward data to both third party and indexer servers without increasing the outbound traffic of the source server?

hyatt_calvin
Engager

I am fairly new to Splunk. The company I work for already has Splunk universal forwarders installed on servers to pull log content out to Splunk servers to index. Now we would like to forward the same log content to a 3rd party system. Naturally we will add the following to outputs.conf:

server = "third-party host:port"
sendCookedData = false

alt text

As far as I'm concerned, in this setup, Splunk forwarders would bifurcate log content to both Splunk servers and third-party servers, like the above diagram. It is increasing outbound traffic of the log server. Is there is any suggestion to avoid that on the log server?

Would putting servers with heavy forwarders in the between servers with Splunk Forwarders and Splunk index servers help, like in the following diagram?

alt text

I am not sure if Splunk heavy forwarder would be able to convert cooked (I guess unparsed) data to uncooked. Maybe this is over-engineered. Basically we would like to forward log content to third-party servers and avoid the increase of outbound traffic of the content-generated server.

Any suggestion is appreciated. Thanks.

tyrone_osilesi7
Explorer
0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...