topic Re: How to forward indexed data to another syslog server? in Getting Data In

How to forward indexed data to another syslog server?

satishsdange — Tue, 17 May 2016 15:47:16 GMT

Hi Gang -

I know this question has been asked and answered several times, but I could not fix my problem. Could someone please help me out

root@ip-172-31-26-78:/opt/splunk/etc/system/local# cat inputs.conf
[monitor:///var/log/syslog]
host = splunk_indx
sourcetype = syslog
root@ip-172-31-26-78:/opt/splunk/etc/system/local# cat outputs.conf
[tcpout:syslog]
server = 54.169.86.31:514
sendCookedData = false


root@ip-172-31-26-78:/opt/splunk/etc/system/local# cat props.conf
[syslog]
TRANSFORMS-forward = syslogTcpOut
root@ip-172-31-26-78:/opt/splunk/etc/system/local# cat transforms.conf
[syslogTcpOut]
REGEX = .
DEST_KEY=_TCP_ROUTING
FORMAT=syslog
root@ip-172-31-26-78:/opt/splunk/etc/system/local#

BTW, I have referred this post https://answers.splunk.com/answers/65818/forward-data-to-a-third-party-system.html

Thank you so much!!!

Re: How to forward indexed data to another syslog server?

somesoni2 — Tue, 17 May 2016 15:55:27 GMT

The props and transforms should be in Heavy Forwarder/Indexers. It seems like you did all these on the forwarder itself. (read comment#4 on the reference answer)

Re: How to forward indexed data to another syslog server?

satishsdange — Tue, 17 May 2016 16:21:48 GMT

Config is from indexer.

Re: How to forward indexed data to another syslog server?

satishsdange — Wed, 18 May 2016 03:18:46 GMT

Any taker for this question?

Re: How to forward indexed data to another syslog server?

jmallorquin — Wed, 18 May 2016 08:17:18 GMT

Hi satishsdange,

I recomend you to change this in your configuration

root@ip-172-31-26-78:/opt/splunk/etc/system/local# cat outputs.conf
 [tcpout:syslog_forward]
 server = 54.169.86.31:514
 sendCookedData = false


 root@ip-172-31-26-78:/opt/splunk/etc/system/local# cat transforms.conf
 [syslogTcpOut]
 REGEX = .
 DEST_KEY=_TCP_ROUTING
 FORMAT=syslog_forward

Hope i help you.

Re: How to forward indexed data to another syslog server?

satishsdange — Wed, 18 May 2016 16:22:00 GMT

Unfortunately it did not work.