topic Re: Forward subset of logs via _TCP_ROUTING in Getting Data In

Forward subset of logs via _TCP_ROUTING

sonicZ — Wed, 31 Jul 2013 19:22:11 GMT

Using a heavy forwarder I'm having some issues using the _TCP_ROUTING examples posted in splunk docs and some splunk base answers.
I am just trying to forward a specific sourcetype log type to another forwarder, Is this correct or is there anything i am doing wrong?

in props.conf
[somesourcetype]
TRANSFORMS-log_subset = some_logs

In transforms.conf
[some_logs]
REGEX = .
DEST_KEY=_TCP_ROUTING
FORMAT=some_logs_subset

In outputs.conf
[tcpout:some_logs_subset]
server=serverip:port

Re: Forward subset of logs via _TCP_ROUTING

lmyrefelt — Mon, 28 Sep 2020 14:29:04 GMT

you can do it with a combination of inputs and outputs.

inputs.conf

[monitor:///some/path/to/some/files/]
_TCP_ROUTING = my_new_route
source =
sourcetype =
host =
blacklist =

outputs.conf

[tcpout]
defaultGroup = our_default_route

[tcpout:out_default_route]
server = 0.0.0.0:0000

[tcpout:our_new_route]
server = 1.1.1.1:1111

Re: Forward subset of logs via _TCP_ROUTING

sonicZ — Thu, 01 Aug 2013 22:02:51 GMT

The only problem i have is we have an input on
[splunktcp:port]

That basically has a lot of data coming in from, the sourcetype is mixed in with that data so we only want to forward data that is of that particular sourcetype, preferably not changing the inputs.conf ports

Re: Forward subset of logs via _TCP_ROUTING

lmyrefelt — Fri, 02 Aug 2013 07:04:55 GMT

what kind of forwarder are you using? Can it be that you need another kind of forwarder (ie. heavy) to what u want?

Re: Forward subset of logs via _TCP_ROUTING

Drainy — Fri, 02 Aug 2013 08:28:15 GMT

Your config looks fine to me.

Have you correctly defined the input on the other side and tested connectivity?

Re: Forward subset of logs via _TCP_ROUTING

sonicZ — Mon, 28 Sep 2020 14:31:02 GMT

I basically just have this on the receiving forwarder
connectivity is fine in splunkd logs from forwarder to forwarder and via port connect tests(telnet)

[splunktcp://9997]
connection_host = dns
index = iseclog_core
sourcetype = logger_cef

Re: Forward subset of logs via _TCP_ROUTING

sonicZ — Tue, 06 Aug 2013 20:06:42 GMT

I should also mention this is a spunk 4.3.3 instance forwarding to splunk 5.0.3

Re: Forward subset of logs via _TCP_ROUTING

sonicZ — Tue, 06 Aug 2013 20:07:45 GMT

This is a heavy forwarder receiving multiple inputs on different ports, so i am using props and transforms .conf files specified in original post.

Re: Forward subset of logs via _TCP_ROUTING

sonicZ — Tue, 06 Aug 2013 20:13:26 GMT

Also another oddity is if i specify
[tcp://9997]
instead of splunktcp the data comes in indexed but since its still coming in cooked.

--splunk-cooked-mode-v3--\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00 etc...

So connectivity seems fine just seems like this instance is not handling cooked "spunktcp" data correctly.