topic Re: forward logs from HF to third-party using syslog in Getting Data In

forward logs from HF to third-party using syslog

KhalidAlharthi — Sun, 09 Jun 2024 08:17:07 GMT

i have used this approach to forward logs from specific index to third-party system in my case Qradar

so i need to do the same forwarding specific index using syslog not TCP cuz it's takes time ( i did tcpdump to figure that)

this approach i follow

# props.conf

[default]
TRANSFORMS-send_foo_to_remote_siem

# transforms.conf

[send_foo_to_remote_siem]
REGEX = foo
SOURCE_KEY = _MetaData:Index
DEST_KEY = _TCP_ROUTING
FORMAT = remote_siem

# outputs.conf

[tcpout:remote_siem]
server = remotesiem:1234
sendCookedData = false

thanks

Re: forward logs from HF to third-party using syslog

gcusello — Sun, 09 Jun 2024 09:49:53 GMT

Hi @KhalidAlharthi ,

does it run your solution?

I found an error: the transformation is missed in the props.conf.

I'm not sure that you can put the TRANSFORMS in Default stanza and I don't like to use a regex on index field, I'd use a different approach:

# props.conf [your_sourcetype] TRANSFORMS-send_foo_to_remote_siem = send_foo_to_remote_siem # transforms.conf [send_foo_to_remote_siem] REGEX = . DEST_KEY = _TCP_ROUTING FORMAT = remote_siem # outputs.conf [tcpout:remote_siem] server = remotesiem:1234 sendCookedData = false

then put attention to the sourcetype: you must be sure that you are using, in the props.conf, the original sourcetype and not a transformed (by the add-on) one.

Ciao.

Giuseppe

Re: forward logs from HF to third-party using syslog

KhalidAlharthi — Sun, 09 Jun 2024 10:01:01 GMT

by this you are sending all the event to remote siem

i need to send just TMAO trend micro

soo what the best approach to do this using syslog ...

Re: forward logs from HF to third-party using syslog

gcusello — Sun, 09 Jun 2024 10:06:31 GMT

Hi @KhalidAlharthi ,

in props.conf, you have to use only the sourcetype of the logs to send to syslog.

If they are more than one, put more stanzas in props.

# props.conf [TMAO_sourcetype] TRANSFORMS-send_foo_to_remote_siem = send_foo_to_remote_siem # transforms.conf [send_foo_to_remote_siem] REGEX = . DEST_KEY = _TCP_ROUTING FORMAT = remote_siem # outputs.conf [tcpout:remote_siem] server = remotesiem:1234 sendCookedData = false

AS I said, check the exact sourcetype name: I recently solved an issue near your, where the error was the sourcetype exact name.

Ciao.

Giuseppe

Re: forward logs from HF to third-party using syslog

KhalidAlharthi — Sun, 09 Jun 2024 10:19:32 GMT

Thanks @gcusello

is it possible to define it like what you did

[TMAO_sourcetype]

and if yes sourcetype of data source right?

Re: forward logs from HF to third-party using syslog

gcusello — Sun, 09 Jun 2024 16:11:54 GMT

Hi @KhalidAlharthi ,

yes (I saw your other question!).

let me know if I can help you more, or, please, accept one answer for the other people of Community.

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉

Re: forward logs from HF to third-party using syslog

KhalidAlharthi — Sun, 09 Jun 2024 17:39:59 GMT

yeah i picked your solution.

could you please check your DM

Re: forward logs from HF to third-party using syslog

gcusello — Sun, 09 Jun 2024 17:57:35 GMT

Hi @KhalidAlharthi ,

what do you mean with "DM"?

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉

Re: forward logs from HF to third-party using syslog

KhalidAlharthi — Sun, 09 Jun 2024 18:04:03 GMT

@gcusello I sent you private message .

Re: forward logs from HF to third-party using syslog

malisushil119 — Tue, 13 May 2025 03:03:06 GMT

We have installed Splunk in windows and we want to send windows logs from Search Head, LM and CM to 3rd party using an indexer, somehow those logs can be seen in Search head queries but indexer is not forwarding them to 3rd party.

Re: forward logs from HF to third-party using syslog

gcusello — Tue, 13 May 2025 06:45:10 GMT

Hi @malisushil119 ,

don't attach a new post to another one, even if on the same topic because you'll receive a faster and probably better answer.

Ciao.

Giuseppe