How to forward splunkd.log to a foreign syslog server

MattKr — Tue, 10 Sep 2024 14:14:46 GMT

Dear community,
it might be an odd question but i need to forward the splunkd.log to a foreign syslog server,
therefore i was following the sample from here:
https://docs.splunk.com/Documentation/SplunkCloud/9.2.2406/Forwarding/Forwarddatatothird-partysystemsd

So far i have configured the forwarder to forward testing.log (should be splunkd.log later) to the foreign syslog target

#inputs.conf [monitor:///opt/splunk/var/log/splunk/testing.log] disabled=false sourcetype=testing

#outputs.conf [tcpout] defaultGroup=idx-cluster indexAndForward=false [tcpout:idx-cluster] server=splunk-idx-cluster-indexer-service:9997 [syslog:my_syslog_group] server = my-syslog-server.foo:514

#transforms.conf [send_to_syslog] REGEX = . DEST_KEY = _SYSLOG_ROUTING FORMAT = my_syslog_group

So far so good, testing.log appears on the syslog server but not just that, all other messages are forwarded too.

Question: How can i configure the (heavy) forwarder to only send testing.log to the foreign syslog server and
how can i make sure that testing.log does not getting indexed? In other words - testing.log should only be send to syslog.

Many thanks in advance

Re: How to forward splunkd.log to a foreign syslog server

PickleRick — Tue, 10 Sep 2024 21:41:10 GMT

Unless you call that transform from props.conf, it's completely ineffective. But that's just a side note.

There are two separate issues here. One is to make sure only selected events get forwarded to syslog server. The way to go is probably to define two syslog groups - one with a real syslog server and one - a deafult one - with a dummy syslog server. The default syslog output is just a sink to catch all events not redirected using transforms to a working syslog output.

Another thing is to make sure specific data is not getting forwarded using splunk-tcp connection to downstream indexers. You can either use index filtering for this (but this works globally on tcp outputs) or you can do the same thing as with syslog but in reverse - do a dummy output and redirect there all events you don't want sent to indexers.

topic Re: How to forward splunkd.log to a foreign syslog server in Getting Data In

How to forward splunkd.log to a foreign syslog server

Re: How to forward splunkd.log to a foreign syslog server