---
title: "Data Forwarding"
slug: "data-forwarding"
description: "Create a data forwarding rule in a SysTrack role to send an agent table to Splunk or Azure Log Analytics on a schedule."
status: "update"
updated: 2026-10-26T10:40:25Z
published: 2026-10-26T10:40:25Z
canonical: "documentation.lakesidesoftware.com/data-forwarding"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://documentation.lakesidesoftware.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Data Forwarding

Use the **Data Forwarding** settings of a role to send data from an agent table on each system to Splunk or Azure Log Analytics. In order to use it you would need to import a role which is available from your customer success team.

Data forwarding sends only agent-side tables. For the tables to forward to Splunk, see [Suggested SysTrack Tables for Splunk](/documentation/docs/suggested-systrack-tables-for-splunk). For Splunk setup, see [Splunk Integration](/documentation/docs/configure-splunk-integration).

## Create a Data Forwarding Rule

1. Go to **Configure** > **System Configuration** > **Roles**.
2. Click the lock icon in the upper-right corner to unlock Configure for editing.
3. Select the role.
4. From the **Additional Settings** list, select **Data Forwarding**.

![Data Forwarding table, destination, details](https://cdn.document360.io/87d11426-6b1f-4b19-b593-b71e55a81af3/Images/Documentation/data_forwarding.png?sv=2026-02-06&spr=https&st=2026-11-08T16%3A44%3A24Z&se=2026-11-08T17%3A44%3A24Z&sr=c&sp=r&sig=KQ7uXLyXnaNQfdFnFWd8Ua5eZbG7eOmMRf46lcfN0hE%3D)

1. Click the plus icon to open **Create Data Forwarding Rule**.

![Create data forwarding rule table, destination, schedule type, details, no parameters](https://cdn.document360.io/87d11426-6b1f-4b19-b593-b71e55a81af3/Images/Documentation/data_forwarding2.png?sv=2026-02-06&spr=https&st=2026-11-08T16%3A44%3A24Z&se=2026-11-08T17%3A44%3A24Z&sr=c&sp=r&sig=KQ7uXLyXnaNQfdFnFWd8Ua5eZbG7eOmMRf46lcfN0hE%3D)

1. Complete the rule:

- **Table**: Choose the agent-side table to forward to the Splunk or Azure server.
- **Destination**: For Splunk, the name of the Splunk index that receives the data.
- **Schedule Type**: Choose when you want to send the data. Options are **Always On**, **Active User**, **Sensor Based**, **Health**, and **SQL**.

![Data Forwarding Rule Schedule Type drop-down with always on, active user, sensor based, health, and SQL options](https://cdn.document360.io/87d11426-6b1f-4b19-b593-b71e55a81af3/Images/Documentation/data_forwarding-schedule.png?sv=2026-02-06&spr=https&st=2026-11-08T16%3A44%3A24Z&se=2026-11-08T17%3A44%3A24Z&sr=c&sp=r&sig=KQ7uXLyXnaNQfdFnFWd8Ua5eZbG7eOmMRf46lcfN0hE%3D)

- If you choose **Sensor Based** you can select the sensor from the drop-down.

![Schedule Type Sensor Based choose a sensor from the drop-down](https://cdn.document360.io/87d11426-6b1f-4b19-b593-b71e55a81af3/Images/Documentation/data_forwarding-sensor.png?sv=2026-02-06&spr=https&st=2026-11-08T16%3A44%3A24Z&se=2026-11-08T17%3A44%3A24Z&sr=c&sp=r&sig=KQ7uXLyXnaNQfdFnFWd8Ua5eZbG7eOmMRf46lcfN0hE%3D)
- If you choose **Health**, enter the health score below which the data is sent. The default is 85.

![Schedule Type when the health score falls below a set number](https://cdn.document360.io/87d11426-6b1f-4b19-b593-b71e55a81af3/Images/Documentation/data_forwarding-health.png?sv=2026-02-06&spr=https&st=2026-11-08T16%3A44%3A24Z&se=2026-11-08T17%3A44%3A24Z&sr=c&sp=r&sig=KQ7uXLyXnaNQfdFnFWd8Ua5eZbG7eOmMRf46lcfN0hE%3D)
- If you choose **SQL** it will test the query periodically and send data.

![Data forwarding schedule type is SQL](https://cdn.document360.io/87d11426-6b1f-4b19-b593-b71e55a81af3/Images/Documentation/data_forwarding-sql.png?sv=2026-02-06&spr=https&st=2026-11-08T16%3A44%3A24Z&se=2026-11-08T17%3A44%3A24Z&sr=c&sp=r&sig=KQ7uXLyXnaNQfdFnFWd8Ua5eZbG7eOmMRf46lcfN0hE%3D)

1. Click **OK**, and then click **Save Changes**.

Systems that use the role apply the change the next time they read their configuration. To apply it right away, run **Read Configuration** on those systems. See [Operations: Command Dashboard](/documentation/docs/operations-command-dashboard).

To check that data arrives in Splunk, search the index that you entered in **Destination**. For questions about forwarding SysTrack admin logs, see [Information Regarding Forwarding SysTrack Admin Logs to Splunk](/documentation/docs/information-regarding-forwarding-systrack-admin-logs-to-splunk).