topic Re: Prevent Indexer from indexing whilst forwarding syslog to a 3rd party system in Splunk Enterprise

Prevent Indexer from indexing whilst forwarding syslog to a 3rd party system

bvv — Wed, 30 Sep 2020 04:24:55 GMT

outputs.conf

[syslog:syslogGroup]
server = x.x.x.x:514

props.conf

[helloworld]
TRANSFORMS-rsyslog = syslogRouting

transforms.conf

[syslogRouting]
REGEX = .
DEST_KEY = _SYSLOG_ROUTING
FORMAT = syslogGroup

This config is applied on an indexer (many tutorials use a heavy forwarder which by defaults does not index data). This works perfectly in forwarding rawdata in syslog to another system however rawdata is also being indexed. Is there a way to prevent indexing from happening?

I've tried adding a nullQueue stanza to props.conf without luck.

Re: Prevent Indexer from indexing whilst forwarding syslog to a 3rd party system

manjunathmeti — Wed, 26 Feb 2020 14:49:14 GMT

Set index = false for indexAndForward in outputs.conf.

[indexAndForward]
index=false

Re: Prevent Indexer from indexing whilst forwarding syslog to a 3rd party system

bvv — Thu, 27 Feb 2020 00:56:06 GMT

This will stop not just [helloworld] but all other indexes from indexing.

The splunk instance itself is an Indexer and a Search Head at the same time.

Re: Prevent Indexer from indexing whilst forwarding syslog to a 3rd party system

masonmorales — Thu, 27 Feb 2020 01:04:17 GMT

Is the data already cooked when it hits the indexer? / What's forwarding the data to the indexer?

Re: Prevent Indexer from indexing whilst forwarding syslog to a 3rd party system

bvv — Thu, 27 Feb 2020 01:12:17 GMT

Data is not not cooked
UF-->This splunk instance (both Indexer and Search Head role)

Re: Prevent Indexer from indexing whilst forwarding syslog to a 3rd party system

manjunathmeti — Wed, 30 Sep 2020 04:25:13 GMT

You can try this. Set selectiveIndexing = true. And remove attribute _INDEX_AND_FORWARD_ROUTING if added under monitor stanza in inputs.conf. This makes forwarder to not index this data.

[indexAndForward]
index=true
selectiveIndexing = true

Re: Prevent Indexer from indexing whilst forwarding syslog to a 3rd party system

bvv — Thu, 27 Feb 2020 06:56:48 GMT

This stopped indexing on all indexes as well..
I might consider setting up a HF to pick up data from UF instead of sending directly to Indexer.