topic Re: Heavy forwarder configuration in Splunk Enterprise

Heavy forwarder configuration

jchermitte — Thu, 02 Sep 2021 13:46:09 GMT

Bonjour,

J'ai activé le heavy forwarder sur mon Splunk server (8.0.6) afin de pouvoir forwarder des logs vers un serveur tiers avec qradar.

Nous avons identifié 4 sourcetypes pour lesquels forwarder les logs (on ne veut pas tout forwarder).

Or il apparaît que la machine cible reçoit toutes les logs. Je pensais que ma conf du outputs.conf ferait en sorte que seules les logs correspondants à ces sourcetypes seraient forwardées.

Voici le contenu de mon fichier tcpouts.conf :

[syslog]
defaultGroup=syslogGroup

[syslog:syslogGroup]
server = 192.168.152.68:514

[syslog:192.168.152.68:514]
syslogSourceType = f5:bigip:syslog
syslogSourceType = bluecoat:proxysg:access:syslog
syslogSourceType = FO_apache
syslogSourceType = backbone_in

Quelqu'un saurait comment filtrer pour ne forwarder que les logs de ces 4 sourcetypes ?

Merci,

Re: Heavy forwarder configuration

gcusello — Thu, 02 Sep 2021 14:05:36 GMT

Hi @jchermitte,

sorry if I answer to you in english (the official language of this Community!) but I know only this language and italian that helped me to understand your question.

Anyway, you have to follow the configurations described at https://docs.splunk.com/Documentation/Splunk/8.2.2/Forwarding/Forwarddatatothird-partysystemsd#Send_a_subset_of_data_to_a_syslog_server

outputs.conf (not tcpout.conf!)

[syslog:syslogGroup] server = 192.168.152.68:514

props.conf

[your_sourcetype_1] TRANSFORMS-syslog = send_to_syslog [your_sourcetype_2] TRANSFORMS-syslog = send_to_syslog [your_sourcetype_3] TRANSFORMS-syslog = send_to_syslog [your_sourcetype_4] TRANSFORMS-syslog = send_to_syslog

transforms.conf

[send_to_syslog] REGEX = . DEST_KEY = _SYSLOG_ROUTING FORMAT = syslogGroup

Ciao.

Giuseppe

Re: Heavy forwarder configuration

jchermitte — Mon, 06 Sep 2021 15:25:42 GMT

Hi Guiseppe,

Thanks for your answer, i will try this asap.

Re: Heavy forwarder configuration

gcusello — Mon, 06 Sep 2021 15:29:01 GMT

Hi @jchermitte,

Ok, let me know and, if the answer solves your need, please accept it foir the other people of Community.

Ciao.

Giuseppe

P.S.: Karma Points are appreciated 😉