topic Re: Receiving data via Splunk Forwarder, I want to forward it as syslog in Getting Data In

Receiving data via Splunk Forwarder, I want to forward it as syslog

Dimitri_McKay — Wed, 18 Dec 2013 13:41:31 GMT

The original data is NOT syslog, and it's coming via universal forwarder, but I would like to forward it from my Splunk indexer onward to a 3rd party receiver as UDP Syslog. Can we take data that is from a monitor stanza in a universal forwarder, index it, and then also send it in raw syslog format. Has anyone faced this challenge and come up with a solution?

Outputs.conf:

[syslog:syslog_out]
server = 209.83.194.68:514
type = udp
timestampformat = %b %e %H:%M:%S

Transforms.conf

[trapfields]
DELIMS = "~"
FIELDS = A1,A2,A3,A4,trapagt,trapsrc,oid,A8
[syslog_routing]
REGEX = .
DEST_KEY = _SYSLOG_ROUTING
FORMAT = syslog_out

Props.conf

[traplog]
TZ = UTC
pulldown_type = 1
REPORT-f1 = trapfields
[impact]
TZ = UTC
pulldown_type = 1
MAX_TIMESTAMP_LOOKAHEAD=50
NO_BINARY_CHECK=1
[nc_syslog]
TZ = UTC
pulldown_type = 1
MAX_TIMESTAMP_LOOKAHEAD=50
NO_BINARY_CHECK=1
[syslog_test]
TRANSFORMS-routing = syslog_routing

Splunk version 5.0.4

Re: Receiving data via Splunk Forwarder, I want to forward it as syslog

MuS — Wed, 18 Dec 2013 13:44:13 GMT

is this not working for you? http://docs.splunk.com/Documentation/Splunk/6.0.1/Forwarding/Forwarddatatothird-partysystemsd#Syslog_data

Re: Receiving data via Splunk Forwarder, I want to forward it as syslog

Dimitri_McKay — Wed, 18 Dec 2013 13:46:51 GMT

That's where I started. I'm not sure if there was something I missed.

Re: Receiving data via Splunk Forwarder, I want to forward it as syslog

MuS — Wed, 18 Dec 2013 13:54:23 GMT

Did you check that there is nothing blocking UDP traffic from IDX to syslog server? Any possible typo in sourcetype name? Have you tried what docs tell you, for example forward everything from one host? This way you can tell if it is working or not.....

Re: Receiving data via Splunk Forwarder, I want to forward it as syslog

jtrucks — Wed, 18 Dec 2013 13:54:31 GMT

What is actually happening? Obviously it isn't fully functional, but have you looked at tcpdump on the Splunk forwarder to see if the data going out that port looks correct? Have you looked on the syslog end-point system with tcpdump to see if it is getting any data in on that port?

Re: Receiving data via Splunk Forwarder, I want to forward it as syslog

Dimitri_McKay — Wed, 18 Dec 2013 13:56:15 GMT

I sat watching a tcpdump on the forwarder for any activity. There was zero.

Re: Receiving data via Splunk Forwarder, I want to forward it as syslog

jtrucks — Wed, 18 Dec 2013 14:11:07 GMT

I'd go with MuS' suggestion: start with forwarding EVERYTHING to syslog then slowly build your config out to forward only those things you want. Also, this is possibly useful: http://wiki.splunk.com/Community:Test:How_Splunk_behaves_when_receiving_or_forwarding_udp_data

Re: Receiving data via Splunk Forwarder, I want to forward it as syslog

Dimitri_McKay — Wed, 18 Dec 2013 17:28:41 GMT

Strangely enough, I believe it was related to syslog running on the customers box which owned the port which is why we weren't seeing anything in the tcpdump. But it's now working. So #win. Thanks all for your help.