topic Re: How to send Windows events to a third-party server using Splunk Universal Forwarder? in Getting Data In

How to send Windows events to a third-party server using Splunk Universal Forwarder?

raduand — Thu, 24 Aug 2017 07:17:20 GMT

Hello,

I'm trying to send windows events using an Universal Forwarder to a 3rd party system.

I configured outputs.conf as shown below:

[tcpout]
defaultGroup = primary_indexers

[tcpout:primary_indexers]
server = indexer1:9997,indexer2:9997, etc
autoLB = true
compressed = true

[tcpout:exernal]
server=10.10.10.10:514
sendCookedData=false

The forwarder has an inputs.conf which looks for WinEvent:Security. The events are reaching the splunk indexers successfully...but not the 3rd party server. The 3rd party server is only receiving splunk internal events, which tells me that the outputs.conf stanza is correct and i have connectivity between the 2 machines.

Is there anything specific i need to configure in order to forward the windows events to the 3rd party server as well? I only need to send the raw events, no other parsing/transformation is needed. Any suggestion would be highly appreciated.

Thanks!

Re: How to send Windows events to a third-party server using Splunk Universal Forwarder?

gcusello — Thu, 24 Aug 2017 08:07:51 GMT

Hi raduand,
as described at http://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Forwarddatatothird-partysystemsd , you should try to delete (or comment) the first stanza in outputs.conf

[tcpout]
defaultGroup = primary_indexers

Bye.
Giuseppe

Re: How to send Windows events to a third-party server using Splunk Universal Forwarder?

raduand — Thu, 24 Aug 2017 11:05:50 GMT

Thanks! Now it's sending something but the windows events are multi-line and i'd like to receive the full event in a single line on the 3rd party destination. Is that possible?

Re: How to send Windows events to a third-party server using Splunk Universal Forwarder?

gcusello — Fri, 25 Aug 2017 08:53:13 GMT

Hi raduand,
I don't think that it's possible because you're sending uncooked data, you should parse data in the destination system to aggregate rows in a single log, or use cooked data and parse them in the destination system.
Bye.
Giuseppe

Re: How to send Windows events to a third-party server using Splunk Universal Forwarder?

raduand — Fri, 25 Aug 2017 08:55:09 GMT

Cool, then i believe i need to use an intermediate Heavy Forwarder to parse the logs then forward them to the 3rd party destination.

Thanks a lot and best regards,
Andrei

Re: How to send Windows events to a third-party server using Splunk Universal Forwarder?

Log_wrangler — Tue, 02 Oct 2018 14:05:05 GMT

I am having the same problem, did you get this to work??? Thanks

Re: How to send Windows events to a third-party server using Splunk Universal Forwarder?

vonsolo29 — Tue, 29 Sep 2020 22:44:34 GMT

We are trying to do something similar but we want the UF to send the same data to both our indexer group and the third party system. Is this possible? we configured the _TCP_ROUTING property to use both tcpout stanzas for indexer-gorup and secops-server but the data in the secops-server is not correct. It looks as though its just internal splunk logs/metrics from the UF and not windows event logs.

Re: How to send Windows events to a third-party server using Splunk Universal Forwarder?

gcusello — Fri, 11 Jan 2019 07:53:19 GMT

Hi vonsolo29,
did you inserted the option sendCookedData=false in the outputs.conf's external stanza?
in addition, you have to modify also the other inputs.conf, probably you're sending also the Splunk internal logs.
Bye.
Giuseppe

Re: How to send Windows events to a third-party server using Splunk Universal Forwarder?

vonsolo29 — Tue, 29 Sep 2020 22:45:02 GMT

this is what i have in the outputs

[tcpout]
defaultGroup = indexer-group

[tcpout:indexer-group]
server = SPLUNKINDEXERSERVER:9997,SPLUNKINDEXERSERVER:9997,SPLUNKINDEXERSERVER:9997

[tcpout:thirdpartytest-system]
server = THIRDPARYSERVER:5114
sendCookedData = false

this is what the inputs shows:

[WinEventLog://Security]
disabled = 0
index = wineventlog
_TCP_ROUTING = indexer-group,thirdpartytest-system