topic Re: Forwarding selected events from Indexer to thrid-party application in Getting Data In

Forwarding selected events from Indexer to thrid-party application

tobiasvollrath — Mon, 28 Sep 2020 14:43:17 GMT

Hi,
in our system we have same universal forwarders, one indexer and a third-party system that expect only events in syslog-format.

How can I send selected events from the indexer via syslog to my third-party system. That selected events should not save in the indexer. All other events should be indexed.

Is there a way to do this?

I try this configuration, but the index sent all events via syslog.

#inputs.conf [splunktcp-ssl://9997] _SYSLOG_ROUTING = syslog_test

#outputs.conf [syslog:syslog_test] server = 192.168.0.42:10514

Thanks for your help,
with best greetings

Tobias

Re: Forwarding selected events from Indexer to thrid-party application

fbl_itcs — Mon, 28 Sep 2020 14:43:23 GMT

Hi,

you can do that with a transformation.

You define the output in your outputs.conf. Then you create a transformation using props.conf and transforms.conf:

props.conf:

[sourcetypename OR host::HOSTNAME OR source::SOURCENAME]
TRANSFORMS-syslog = syslog_out

transforms.conf

[syslog_out]
REGEX = REGEX_TO_FILTER_EVENTS_GOES_HERE
DEST_KEY=_SYSLOG_ROUTING
FORMAT=syslog_test

Re: Forwarding selected events from Indexer to thrid-party application

tobiasvollrath — Fri, 06 Sep 2013 14:15:54 GMT

It works! Thanks a lot.

But there is one open querstion:

The indexer should not index the events wich go out via syslog. Is this posible?