topic How to Forward Splunk WMIEventLog:Security to syslog_ng with backend MYSQL in Getting Data In

How to Forward Splunk WMIEventLog:Security to syslog_ng with backend MYSQL

smile_4u_2 — Thu, 16 Feb 2012 22:01:00 GMT

I am new to Splunk and am attempting to forward Splunk WMIEventLog:Security to syslog_ng with a backend MYSQL. This is a requirement for our log archives.
I can setup a forwarder to Forward Splunk data via TCP, but the message Field is blank.

Can anyone assit me with How to Forward Splunk WMIEventLog:Security data to syslog_ng with a backend MYSQL?

Re: How to Forward Splunk WMIEventLog:Security to syslog_ng with backend MYSQL

solarboyz1 — Wed, 29 Feb 2012 21:16:44 GMT

The following configuration is for a heavy forwarder on the windows box, it will forward your Windows Security event log in syslog format to the syslog_ng server you define in the outputs.conf.

inputs.conf:

        [WinEventLog:Security]
        disabled = 0

outputs.conf

        [syslog:syslog_ng]
        server  = 12.34.56.78:514
        type = udp

props.conf

        [host::*]
        TRANSFORMS-routing = syslog_ng

transforms.conf

        [send_to_syslog]
        REGEX = .
        DEST_KEY = _SYSLOG_ROUTING
        FORMAT = syslog_ng

I'm assuming you already have the syslog-ng backend configured to push the data into your mysql database, but if not those directions can be found here: http://sqls.net/wiki/howto:syslog-ng_to_mysql

Re: How to Forward Splunk WMIEventLog:Security to syslog_ng with backend MYSQL

ephemeric — Mon, 28 Sep 2020 14:43:33 GMT

Should it not be "TRANSFORMS-routing = send_to_syslog"?