Send only few events

andreas_linden — Fri, 15 Feb 2019 08:20:38 GMT

Hello Splunk Support,

we have the following problem:
- We must send a log file to different receiver:
-- a Splunk server and the splunk server need ALL events
-- a non-splunk server, but only few events, so a whitelisting solution

I found the following documentation
https://answers.splunk.com/answers/9076/how-to-configure-a-forwarder-to-filter-and-send-only-the-events-i-want.html

Now my questions:
- Could I combine both solution – all events to one server and few events to another server??

Re: Send only few events

DMohn — Fri, 15 Feb 2019 13:42:34 GMT

Yes, that would be possible if you use a Heavy Forwarder for that. The feature you are looking for is called "Event Routing"

You need to configure both servers in the outputs.conf of your forwarder, one as tcpout (for the Splunk Server), and one as syslog output (for the non-splunk server)

[tcpout:splunkindexer]
disabled = false
server = ip.of.ind.exr

[syslog:syslogout]
server = ip.of.sys.log:514
type = udp

Then you need to adjust the props.conf of the respective source or sourcetype

[yoursourcetype]
TRANSFORMS-routing = routeAll, routeSubset

Finally, create a transforms.conf that does the filtering and routing

[routeAll]
REGEX=(.)
DEST_KEY=_TCP_ROUTING
FORMAT=splunkindexer

[routeSubset]
REGEX=(your_regex_to_filter)
DEST_KEY=_TCP_ROUTING
FORMAT=splunkindexer,syslogout

Please refer to the splunk docs for details: https://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Routeandfilterdatad#Replicate_a_subset_of_data_to_a_third-party_system

topic Re: Send only few events in Deployment Architecture

Send only few events

Re: Send only few events