Forwarding all logs from HF to third-party using syslog and discard tcp output to indexers

frank_yin — Thu, 28 Aug 2025 07:26:11 GMT

My goal is to:

1. Default send everything from UF agent (excluded syslog source) to syslog group: chron-autolb group.
2. Do not send anything to tcp output group "idx-autolb-group" unless explicitly allowed for sourcetype such as “WinEventLog” and “auditd”

However when I set below, I can still receive everything on my Splunk indexers, please advise, Thanks.

# outputs.conf

[syslog]
defaultGroup = chron-autolb-group

[syslog:chron-autolb-group]
server = X.X.X.X:514

[tcpout:idx-autolb-group]
disabled = false
server = A.A.A.A:9997, B.B.B.B:9997, C.C.C.C:9997
sslCertPath = $SPLUNK_HOME/etc/auth/server.pem
sslPassword = xxxxxxxx
sslRootCAPath = $SPLUNK_HOME/etc/auth/cacert.pem
sslVerifyServerCert = false

# props.conf

###Filter out Syslog sourcetype
#Network
[(?::){0}bluecoat*]
TRANSFORMS-null = setnull
[(?::){0}cisco*]
TRANSFORMS-null = setnull
[(?::){0}cp_log*]
TRANSFORMS-null = setnull
[(?::){0}fort*]
TRANSFORMS-null = setnull
[(?::){0}opsec*]
TRANSFORMS-null = setnull
[(?::){0}pan*]
TRANSFORMS-null = setnull
[(?::){0}tipping*]
TRANSFORMS-null = setnull

#EDR/Others
[bit9:carbonblack:json]
TRANSFORMS-null = setnull
[carbonblack]
TRANSFORMS-null = setnull
[(?::){0}digital*]
TRANSFORMS-null = setnull
[(?::){0}deepsecurity*]
TRANSFORMS-null = setnull
[(?::){0}fe*]
TRANSFORMS-null = setnull
[(?::){0}horizon*]
TRANSFORMS-null = setnull
[ibm:was:httpErrorLog]
TRANSFORMS-null = setnull
[(?::){0}morph*]
TRANSFORMS-null = setnull
[(?::){0}mobileiron*]
TRANSFORMS-null = setnull
[(?::){0}symantec*]
TRANSFORMS-null = setnull
[(?::){0}vmware*]
TRANSFORMS-null = setnull

###Allowed Sourcetype
[(?::){0}WinEventLog*]
TRANSFORMS-routing = chron_transforms_stanza, onperm_transforms_stanza
[wineventlog]
TRANSFORMS-routing = chron_transforms_stanza, onperm_transforms_stanza
[WMI:WinEventLog:Security]
TRANSFORMS-routing = chron_transforms_stanza, onperm_transforms_stanza
[auditd]
TRANSFORMS-routing = chron_transforms_stanza, onperm_transforms_stanza
[aixaud]
TRANSFORMS-routing = chron_transforms_stanza, onperm_transforms_stanza
[solbsm]
TRANSFORMS-routing = chron_transforms_stanza, onperm_transforms_stanza
[lastlog]
TRANSFORMS-routing = chron_transforms_stanza, onperm_transforms_stanza

#Transforms.conf

[onperm_transforms_stanza]
REGEX = .
DEST_KEY = _TCP_ROUTING
FORMAT = idx-autolb-group

[chron_transforms_stanza]
REGEX = .
DEST_KEY = _SYSLOG_ROUTING
FORMAT = chron-autolb-group

[setnull]
REGEX = .
DEST_KEY = queue
FORMAT = nullQueue

Re: Forwarding all logs from HF to third-party using syslog and discard tcp output to indexers

effem3 — Fri, 26 Sep 2025 21:31:20 GMT

See Splunk Documentation.

# The syslog output processor is not available for universal or light
# forwarders.

topic Forwarding all logs from HF to third-party using syslog and discard tcp output to indexers in Getting Data In

Forwarding all logs from HF to third-party using syslog and discard tcp output to indexers

Re: Forwarding all logs from HF to third-party using syslog and discard tcp output to indexers