topic Forward syslog to third part based on field extraction in Getting Data In

Forward syslog to third part based on field extraction

rjordan00 — Mon, 28 Sep 2020 13:55:21 GMT

I'm evaluating Splunk for our syslog needs. One of our final requirements is to have the ability to forward syslog messages to another system. Specifically, we need to forward messages based on the source host, severity level, or event code.
I've already checked out the article on sending a subset of data to a syslog server. In the example they show how you can apply forwarding to a host in props.conf. I'd like to know how I can do this based on field extractions. For instance, I'd like to forward all messages of a severity critical or greater to my other syslog server. I can do this by defining the REGEX in transforms.conf (see below for example), but this can get kind of sloppy. I already have the field extractions defined for the sourcetypes. I just don't know how to go about using them in this scenario.

props.conf
[source::udp:514]
TRANSFORMS-syslog_forwarder = send_to_syslog

transforms.conf
[send_to_syslog]
REGEX = %\w+-[012]-\w+
DEST_KEY = _SYSLOG_ROUTING
FORMAT = my_syslog_group

outputs.conf
[syslog:my_syslog_group]
server = 192.168.100.100:514

Re: Forward syslog to third part based on field extraction

Ayn — Thu, 16 May 2013 18:19:25 GMT

Not sure how you imagine this would work? Field extractions take place at search-time, not index-time, so these are kind of two different things you're talking about.

Re: Forward syslog to third part based on field extraction

jbsplunk — Thu, 16 May 2013 19:04:21 GMT

You're limited to using the REGEX syntax as a qualifier if you want to transform the data. You can't use field extractions as a qualifier for this type of configuration.

Re: Forward syslog to third part based on field extraction

rjordan00 — Mon, 28 Sep 2020 13:55:24 GMT

Thanks for the answer. On a related note, can I define multiple transforms so I can have different REGEX for different types of events I want to forward? For example, if I want to forward severity critical and higher and also a specific type of Cisco ASA event.

props.conf
[source::udp:514]
TRANSFORMS-syslog_forwarder = syslog_severity, syslog_event

transforms.conf
[syslog_severity]
REGEX = %\w+-[123]-\w+
DEST_KEY = _SYSLOG_ROUTING
FORMAT = my_syslog_group

[syslog_event]
REGEX = %ASA-5-713904
DEST_KEY = _SYSLOG_ROUTING
FORMAT = my_syslog_group

Re: Forward syslog to third part based on field extraction

jbsplunk — Mon, 28 Sep 2020 13:55:27 GMT

Sure, you could do that and it would work, or you could also combine them into a single regex and have one transform for 'syslog'. I suppose if you're going to do a lot of stuff with third party forwarding it might be cleaner to use separate transforms, but either approach would work.

props.conf

[source::udp:514]
TRANSFORMS-syslog_forwarder = syslog

transforms.conf

[syslog]
REGEX = (THIS|THAT|OTHER)
DEST_KEY = _SYSLOG_ROUTING
FORMAT = my_syslog_group