I want to save my indexer disk space and how can I route all my internal log to a 3rd party server

[daniel_splunk]

I want to save my indexer disk space. I setup another server to store all my splunk internal log. How can I route all my internal log to a 3rd party server?

[nickhills]

I think it obvious, but clearly, using the approach above, you wont be able to search this data in splunk since it will never actually get indexed. - That may be ok for you, but since you didn't specify...
-or-
If you have the space on a 3rd party system (lets say a commodity NAS) you could install splunk on another server and present the NAS storage to splunk, and create your indexes there.

Using _TCP_ROUTING as above, you can send your internal (or less searched) data to the second splunk server, which will keep it separate and on the NAS

You can then either use the second server to review your internal logs, or add it as a search peer of your first server (or SH) and have one Search Interface for all of your data - accepting that your internal logs will be less performant than your main indexes.

[daniel_splunk]

You can use _TCP_ROUTING in your inputs.conf to route to different output group. Below are some sample configuration.

inputs.conf
[monitor://$SPLUNK_HOME/var/log/splunk]
index = _internal
_TCP_ROUTING = tcp_3rdparty

outputs.conf
[tcpout]
indexAndForward = false
defaultGroup = noSuchOutputGroup

[tcpout:tcp_3rdparty]
server = 192.168.1.165:22222
blockOnCloning = false
dropEventsOnQueueFull = 5
sendCookedData = false

Remark: You can use netcat to test the setup before you setup the 3rd party server
E.g.
nc -l 22222