SC4S routing configuration not working

L_Petch — Wed, 10 Sep 2025 13:32:22 GMT

Hello,

I am trying to get logs from my opnsense FW to go to an index called prod_opnsense but everything I have tried doesn't seem to make a difference and it still ends up in the LASTCHANCE index.

The latest thing I have tried is below but this also does not work,

I added a new port UDP 515 to my env file. I have checked the opnsense device is sending to this port and can see it in TCPDUMP using it and it makes it to the lastchance index so is not being blocked by any firewall rules etc.

SC4S_DEST_SPLUNK_HEC_DEFAULT_URL=https://HF_IP:8088 SC4S_DEST_SPLUNK_HEC_DEFAULT_TOKEN=TOKEN_ID #Uncomment the following line if using untrusted SSL certificates SC4S_DEST_SPLUNK_HEC_DEFAULT_TLS_VERIFY=no #Add additional listening ports SC4S_LISTEN_OPNSENSE_UDP_PORT=515 SC4S_DEST_GLOBAL_ALTERNATES=d_archive

I added a new logpath file /opt/sc4s/local/config/log_paths/opnsense_515.conf.tmpl

filter f_opnsense_515 { source(s_src_udp_515); # This filter will match the program name "filterlog" program("filterlog"); }; # Log statement to process the traffic log { source(s_src_udp_515); filter(f_opnsense_515); # Set the vendor_product field. This is how SC4S will map the traffic to an index. rewrite { set("sc4s_vendor_product", "opnsense"); }; # Send the processed logs to the Splunk destination destination(d_splunks_ops); };

I then added the below to /opt/sc4s/local/context/splunk_metadata.csv

opnsense,index,prod_opnsense

Anyone know why this is not working?

Re: SC4S routing configuration not working

Meett — Thu, 11 Sep 2025 00:13:07 GMT

Hello @L_Petch This seems to be something around parser itself,
Curious around this line :

destination(d_splunks_ops)

I believe you have shared only half parser above...? can you please share all details? specially what does this d_splunks_ops stands for and what is inside that ? You can also raise support case on this matter if needed .

topic SC4S routing configuration not working in Getting Data In

SC4S routing configuration not working

Re: SC4S routing configuration not working