I referred to the document as shown in http://docs.splunk.com/Documentation/Splunk/6.4.1/Forwarding/Forwarddatatothird-partysystemsd
I can forward the new data which are first indexed to 3rd-party systems, but the old data indexed before can't be forwarded
How can I solve it?
Thanks in advance.
You have several options...
Cold to frozen script <- will push data being deleted due to age / size to third party
ODBC Connector <- will allow you to pull data out of splunk and into third party system
Custom REST script <- will allow you to pull data out of splunk and into third party system