Windows Event Log Configurations for Dual Forwarding

jaracan — Wed, 26 Jun 2024 07:47:02 GMT

Hi Splunkers,

We have requirement to monitor wineventlogswith sourcename MSSQL and will be sent to different sets of IDX.

For global IDX, the wineventlogs inputs will be sourcename MSSQL only
For abc-region, the wineventlogs inputs will be sourcename MSSQL and ComputerName with ending in "abc.com" domain (e.g. XXXXX.abc.com, YYYY.abc.com).

With this, is the configurations below correct? Looking forward to your insights.

##########################################
inputs.conf
#####################################
[WinEventLog://Application]
index=mssql_idx
whitelist= SourceName=%MSSQL%
sourcetype=mssql:app
disabled=false
_TCP_ROUTING=idx-all-global
crcSalt=<SOURCE>

[WinEventLog://Application]
index=mssql_idx
whitelist= SourceName=%MSSQL% ComputerName=%abc.com%
sourcetype=mssql:app
disabled=false
_TCP_ROUTING=idx-abc-region
crcSalt=<SOURCE>

##########################################
outputs.conf
##########################################

[indexAndForward]
index=false

[tcpout]
defaultGroup= idx-all-global, idx-abc-region

[tcpout:idx-all-global]
server=global-idx1:9997, global-idx2:9997

[tcpout:idx-abc-region]
server= abc-region-idx1:9997, abc-region-idx2:9997

topic Windows Event Log Configurations for Dual Forwarding in Getting Data In

Windows Event Log Configurations for Dual Forwarding