Deployment Architecture

Forward search output to Syslog server

yanivamram
Path Finder

Hi All,

I wonder if we could forward a search result output to syslog server?
Something like:
earliest=-1h sourcetype=mysourcetype |

Or else, maybe I could define that whenever Splunk server receive the specific sourcetype data, it will forward it ALSO to a syslog server.

The issue is that I must keep the data on Splunk and can't put a Syslog server in front of the Splunk server.

Thanks in advance!

Tags (1)
0 Karma

somesoni2
SplunkTrust
SplunkTrust

Follow procedure from below link to setup data cloning at your forwarder level (heavy forwarder or universal forwarder whichever you're using), so that the forwarder will send a copy of data for a sourcetype to your indexer and another to your syslog or any third party system (both targets should be specified in outputs.conf and use the FORMAT attribute to specify both targets in comma separated listed)

http://docs.splunk.com/Documentation/Splunk/7.1.1/Forwarding/Routeandfilterdatad#Configure_routing

0 Karma

pruthvikrishnap
Contributor

Hi Yani,

I am not sure if we can send an output result to syslog server, but we can forward whenever Splunk server receive the specific sourcetype data.
You will have to mention the syslog server details in outputs.conf, please find the further details in doc below.

https://docs.splunk.com/Documentation/Splunk/7.1.1/Forwarding/Forwarddatatothird-partysystemsd

Let me know if this helps.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...