topic Re: Forward logs to third party and no duplicates in splunk in Getting Data In

Forward logs to third party and no duplicates in splunk

Anto — Tue, 16 Feb 2021 18:48:57 GMT

I want to forward logs to third party system (syslog) without index these data into splunk but i can't accomplish it, help.

On my heavy forwarder i set up outputs.conf, transforms.conf, props.conf as follow:

outuputs.conf

[syslog:my_syslog_group]
server = <IP>:PORT

transforms.conf

[send_to_syslog]
REGEX = MY REGEX
DEST_KEY = _SYSLOG_ROUTING
FORMAT = my_syslog_group

[not_send_to_syslog]
REGEX = MY REGEX
DEST_KEY =queue
FORMAT =nullQueue

props.conf

[source::MY_SOURCE]
TRANSFORMS-t0=send_to_syslog,not_send_to_syslog

In this way logs don't forward to my syslog, they will be just deleted and not indexed. Removing [not_send_to_syslog] from props and transforms data will be indexed on splunk and also forwarded to syslog.

How can i achieve my problem, sending data to syslog and not indexing them on splunk? Thanks in advantage to those who will help me.

Re: Forward logs to third party and no duplicates in splunk

richgalloway — Tue, 16 Feb 2021 19:07:08 GMT

What's the point of sending data to Splunk if it won't be indexed? Send the syslog data directly to the syslog server.

Re: Forward logs to third party and no duplicates in splunk

Anto — Tue, 16 Feb 2021 19:29:05 GMT

Because i don't need them for the analysis in Splunk but i want to preserve the logs without exceed my license just for 2 GB. So you are telling me that this isn't possible to do directly from splunk? Thank you for your reply, i want just to understand

Re: Forward logs to third party and no duplicates in splunk

scelikok — Wed, 17 Feb 2021 12:55:33 GMT

Hi @Anto,

Can you try changing the order of transforms in props.conf

[source::MY_SOURCE] TRANSFORMS-t0=not_send_to_syslog, send_to_syslog

Re: Forward logs to third party and no duplicates in splunk

Anto — Wed, 17 Feb 2021 13:09:43 GMT

Thank you for your answer but it didn't help. Logs aren't forwarded to syslog and they entered in nullqueue so i don't saw them also in splunk. Any other ideas?

Re: Forward logs to third party and no duplicates in splunk

Anto — Wed, 17 Feb 2021 17:21:59 GMT

I find out the solution. In the transform.conf just replace DEST_KEY as follow:

[not_send_to_syslog]
REGEX = MY REGEX
DEST_KEY =_TCP_ROUTING
FORMAT =nullQueue

All done now. thanks to all

Re: Forward logs to third party and no duplicates in splunk

anilkapoor123 — Fri, 14 Jul 2023 12:21:24 GMT

Hi ,

plese help , how can i send data directly to remote system , or syslog without indexing.

please provide the config settings for inputs.conf, outputs.conf, props.conf , transforms.conf

you help is appreciated.

thanks

Re: Forward logs to third party and no duplicates in splunk

richgalloway — Fri, 14 Jul 2023 12:52:48 GMT

This thread is two years old with an accepted answer. For better chances at getting an answer, please post a new question.

Re: Forward logs to third party and no duplicates in splunk

PickleRick — Fri, 14 Jul 2023 12:59:42 GMT

1. This thread is over two years old. It's usually better to start a new one instead of digging up such antiquities. Possibly linking to the old one for reference what you already found.

2. You already had a solution in this thread.

3. If you don't want to use the data in Splunk in any way why send it there in the first place? It seems to make more sense to send it directly to the destination system.

Re: Forward logs to third party and no duplicates in splunk

anilkapoor123 — Tue, 18 Jul 2023 08:04:28 GMT

@PickleRick

without forwarding data to splunk heavy forwarder i cannot send to syslog server

do you have any alernative for this like to

forward ftop logs from window directory to syslog server without using splunk

Re: Forward logs to third party and no duplicates in splunk

PickleRick — Tue, 18 Jul 2023 08:22:53 GMT

If you just want to pick up log files from local directory on windows computer and send the events from them to a syslog destination, use a syslog daemon for windows (Like NXLog, or Kiwi).