topic Re: forwarder Logs in Getting Data In

forwarder Logs

splkadmin — Wed, 27 Jan 2021 11:01:07 GMT

Hi,

I am forwarding logs to indexer and also to third party server from my universal forwarder

I am sure what we are configured on inputs.conf that only logs will send to indexer

Now I have added another third party server on my outputs.conf , so my question will it sent whole logs or only the inputs.conf file log ..?

Re: forwarder Logs

isoutamo — Wed, 27 Jan 2021 12:01:48 GMT

Can you paste your inputs.conf and outputs.conf here with masked sensitive information? Then it's easier help you.

r. Ismo

Re: forwarder Logs

splkadmin — Wed, 27 Jan 2021 12:33:53 GMT

Pls find the info below

cat splunkforwarder/etc/apps/search/local/inputs.conf
[monitor:///var/log]
disabled = false
index = linux
sourcetype = linux_logs

[monitor:///vitent/skipper/logs.log]
disabled = false
index = linux
sourcetype = linux_logs

sudo cat splunkforwarder/etc/system/local/outputs.conf
[tcpout]
defaultGroup = default-autolb-group,thirdparty

[tcpout:default-autolb-group]
server = 10.x.x.1:9997

[tcpout-server://10.x.x.1:9997]

[tcpout:thirdparty]
server = 10.x.x.x:514
sendCookedData = false

Re: forwarder Logs

isoutamo — Wed, 27 Jan 2021 12:54:05 GMT

Thanks. This configuration seems to be correct.

1) send to splunk idx

2) send to syslog server with udp to port 514

Actually you could drop away [tcpout-server://10.x.x.1:9997] as you don't define anything there.

So what was your actual issue?

Re: forwarder Logs

splkadmin — Wed, 27 Jan 2021 13:14:05 GMT

send to syslog server with udp to port 514

I want to know what are the logs will sent to syslog server through universal forwarder to thirdy party? only the logs I defined in inputs.conf ?

Re: forwarder Logs

isoutamo — Wed, 27 Jan 2021 13:33:51 GMT

With your current configuration it sends all logs to the both target (indexer and syslog).

If you want to send some logs to both and some to only one then you need remove remote-server from default and add into inputs.conf _SYSLOG_ROUTING = <remote group stanza name in outputs.conf for syslog target> to send only that one. That must do on every monitoring stanza.

https://docs.splunk.com/Documentation/Splunk/7.3.3/Admin/Inputsconf

There is also _TCP_ROUTING parameter which is used with indexers.