topic Can I route some data as syslog output to multiple destinations? in Getting Data In

Can I route some data as syslog output to multiple destinations?

Dan — Sat, 26 Jun 2010 03:55:02 GMT

I am indexing data feeds A and B and want to forward just data from B as syslog to servers X and Y (cloning the data stream). How can I do this?

Re: Can I route some data as syslog output to multiple destinations?

Dan — Sat, 26 Jun 2010 05:01:14 GMT

Here is an example config that accomplishes this. I would recommend reading: http://www.splunk.com/base/Documentation/latest/Admin/Configureforwarderswithoutputs.conf

outputs.conf

[syslog]
defaultGroup=nothing
indexAndForward=true

[syslog:serverX]
server = beefysup01:514

[syslog:serverY]
server = 10.1.12.10:514

Note: By default, all events will get sent to all configured target groups. To avoid this, you need to set defaultGroup=nothing ("nothing" can be any name that is not defined as a target group). Then you manually route data to the targets using props and transforms.

props.conf

[source::B]
TRANSFORMS-routing=syslogRouting

Note: This is an example of why you should receive different types of network inputs on different ports. If data feeds A and B were different kinds of syslog (say router data and proxy data), and if both were received on default syslog port 514, then you would have a hard time separating A from B.

transforms.conf

[syslogRouting]
REGEX=.
DEST_KEY=_SYSLOG_ROUTING
FORMAT=serverX,serverY

Note: FORMAT is a comma separated list of target groups, which results in cloning of the data.

Re: Can I route some data as syslog output to multiple destinations?

gkanapathy — Sat, 26 Jun 2010 05:33:14 GMT

I believe that this could be more efficiently accomplished this way, assuming feed A comes in in port 1500, and B comes in on port 1600:

inputs.conf:

[udp:1500]
_SYSLOG_ROUTING = nothing

[udp:1600]
_SYSLOG_ROUTING = serverX,serverY

outputs.conf:

[syslog]
defaultGroup = none

[serverX]
server = x:1234
[serverY]
server = y:1234

Re: Can I route some data as syslog output to multiple destinations?

Dan — Mon, 28 Sep 2020 09:14:05 GMT

I think you can only set _TCPOUT_ROUTING in inputs.conf