topic Re: How to edit outputs.conf for the Splunk Add-on for Check Point OPSEC LEA on a heavy forwarder to route logs to new indexers? in All Apps and Add-ons

How to edit outputs.conf for the Splunk Add-on for Check Point OPSEC LEA on a heavy forwarder to route logs to new indexers?

Splunk_rocks — Tue, 29 Sep 2020 08:49:07 GMT

We have a Splunk setup to get the ASA Check Point logs collected to heavy forwarder and send to an indexer server through the Splunk® Add-on for Check Point OPSEC LEA. That add-on was configured and installed on the Heavy forwarder.

When I checked the input files, I see the following script was added in inputs.conf file
information /opt/splunk/etc/apps/Splunk_TA_opseclea_linux22/bin/lea-loggrabber.sh --configentity Checkpoint

Now we are in the process building new indexer servers and I'm trying to find the way to change the outputs.conf and redirect the logs to the new indexers.

Here is the current data flow.

Checkpoint ---- HF -- old indexer
My new settings will be
Check point - HF - new indexer servers --

If any one knows how to update the outputs Splunk Add-on for Check Point OPSEC LEA, please let me know.

Re: How to edit outputs.conf for the Splunk Add-on for Check Point OPSEC LEA on a heavy forwarder to route logs to new indexers?

mreynov_splunk — Tue, 16 Feb 2016 18:22:52 GMT

This may help: http://docs.splunk.com/Documentation/Splunk/6.3.3/Forwarding/Configureforwarderswithoutputs.confd

Re: How to edit outputs.conf for the Splunk Add-on for Check Point OPSEC LEA on a heavy forwarder to route logs to new indexers?

Splunk_rocks — Tue, 16 Feb 2016 18:58:11 GMT

But my case I want completely redirect from old to new indexers.

Re: How to edit outputs.conf for the Splunk Add-on for Check Point OPSEC LEA on a heavy forwarder to route logs to new indexers?

mreynov_splunk — Tue, 16 Feb 2016 19:33:02 GMT

Do you want to move data previously indexed on old indexers to new indexers? Do you want to use both old indexers and new?

I am not familiar with redirecting from indexers to indexers, if anything - use existing forwarders and edit outputs.conf to forward to new indexers, which is what the link covers.

Re: How to edit outputs.conf for the Splunk Add-on for Check Point OPSEC LEA on a heavy forwarder to route logs to new indexers?

Splunk_rocks — Tue, 29 Sep 2020 08:49:24 GMT

Here is my inputs.conf in

Here is the inputs.conf file in my heavy forwarder
[script:///opt/splunk/etc/apps/Splunk_TA_opseclea_linux22/bin/lea-loggrabber.sh --configentity Checkpoint_XX
_rcvbuf = 1572864
disabled = false
host = XX
index = firewall
interval = 10
passAuth = splunk-system-user
sourcetype = sec

Re: How to edit outputs.conf for the Splunk Add-on for Check Point OPSEC LEA on a heavy forwarder to route logs to new indexers?

Splunk_rocks — Wed, 17 Feb 2016 15:33:13 GMT

I'm just trying to find way to redirect new data to new indexer server.
I don't need to reindex the old data.

Re: How to edit outputs.conf for the Splunk Add-on for Check Point OPSEC LEA on a heavy forwarder to route logs to new indexers?

Splunk_rocks — Tue, 29 Sep 2020 08:46:26 GMT

some times we miss the basic things 🙂

I have found the way it is simple and it worked .

Thanks for your help

adding below stanza to inputs.conf

_TCP_ROUTING = indexset