topic Re: Selectively forwarding syslog to a syslog server in Getting Data In

Selectively forwarding syslog to a syslog server

JovanMilosevic — Mon, 05 Dec 2011 13:09:26 GMT

Hi,

I have a number of syslog feeds coming into my indexer on udp port 514.

I want to forward the syslog from one of the hosts on to another syslog server.

I have set up entries in inputs.conf, props.conf, and transforms.conf, and can successfully forward all syslog data to the syslog server, but cannot do as the manual suggests, and forward from one host.

If I use [syslog] as the stanza name in props.conf, all syslog gets forwarded as one would expect.

If I use [source::upd:514] as the stanza in props.conf, the same - all syslog gets forwarded.

If however, I do as the manual suggests, and use [host::hostname] - nothing gets forwarded. I have also tried using the IP Address instead of the hostname, still nothing.

Am I missing something obvious here ?

Thanks.

Re: Selectively forwarding syslog to a syslog server

AppServices — Mon, 28 Sep 2020 12:41:45 GMT

I believe hostname is referring to the value of host that is set in conjunction with a monitored file.

Being that you are receiving these files via udp, your inputs.conf might look something like this:

[udp://514]
connection_host = syslog.company.com
sourcetype = ltm_log
source = ltm

In this example, you would set hostname to syslog.company.com in props.conf.

Re: Selectively forwarding syslog to a syslog server

Damien_Dallimor — Thu, 25 Oct 2012 20:34:59 GMT

Have a look at the specs for outputs.conf

At the end of that page , you will find a section detailing how to configure props.conf, transforms.conf and outputs.conf to route events to another syslog server

Re: Selectively forwarding syslog to a syslog server

bmacias84 — Thu, 25 Oct 2012 21:13:57 GMT

Why manual are you referring to?

Re: Selectively forwarding syslog to a syslog server

yannK — Fri, 28 Dec 2012 01:07:54 GMT

If you want to forward a subset of your events as syslog, read this document :
http://docs.splunk.com/Documentation/Splunk/5.0.1/Deploy/Routeandfilterdatad#Replicate_a_subset_of_data_to_a_third-party_system