topic Re: Forward data received on a port to a third party system in Getting Data In

Forward data received on a port to a third party system

anton085 — Tue, 29 Sep 2020 15:21:45 GMT

I have a Splunk instance configured to receive data on port 9997 from 2 forwarders. If I want to configure it to forward data received on port 9997, what should I write as the stanza in props.conf?

For example, to forward data from '/var/log', you have to write:
[source::/var/log]
TRANSFORMS-routing = send_to_tcp

What should I write when the source is the port 9997?

Re: Forward data received on a port to a third party system

kmorris_splunk — Tue, 15 Aug 2017 16:37:49 GMT

There is a difference between the receiving port (default 9997) that a forwarder would send data to, and a listening port, say UDP 514 if you are sending syslogs to some port where Splunk is listening for that data stream. All of your data would be coming in to 9997 if it is coming from forwarders. Your source would not reflect the receiving port that the forwarders are sending data to, like it would in the UDP 514 example.

Are you trying to send any data coming from the forwarders on to another destination?

Re: Forward data received on a port to a third party system

anton085 — Tue, 15 Aug 2017 16:47:41 GMT

"Are you trying to send any data coming from the forwarders on to another destination?"

That's exactly what I want to do. Is the props.conf config different for data received on 9997 vs other ports (i.e., 514)?

Re: Forward data received on a port to a third party system

somesoni2 — Tue, 15 Aug 2017 16:51:37 GMT

Are you trying to send all data to a different destination? Cloning the data or just redirecting?

Re: Forward data received on a port to a third party system

anton085 — Tue, 15 Aug 2017 17:12:24 GMT

I am trying to send the data to a third-party system. I would like to see the configs for both cloning and redirecting.

Re: Forward data received on a port to a third party system

masonmorales — Tue, 15 Aug 2017 17:25:42 GMT

I think these docs are what you are looking for:
http://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Forwarddatatothird-partysystemsd
http://docs.splunk.com/Documentation/Splunk/6.6.1/Forwarding/Routeandfilterdatad#Filter_and_route_event_data_to_target_groups
http://docs.splunk.com/Documentation/Splunk/6.6.1/Forwarding/Routeandfilterdatad#Replicate_a_subset_of_data_to_a_third-party_system