topic Re: Receive cooked data to index securitylogs in Splunk Search

Receive cooked data to index securitylogs

nicocin — Tue, 29 Sep 2020 09:17:05 GMT

We have some Appliances (Open System Webproxy), they can send Splunk cooked data into Splunk.

I want to receive the data to a restricted index (securitylogs).

In a first try I configured the listening port in the Webui, Setting -> Forwarding and receiving -> Configure receiving -> added Port 3514

This was working but it was using the main index. So I've reconfigured it in the app "config_all_indexers":

inputs.conf
[splunktcp://3514]
disabled = 0
index = securitylogs

Then I used the "| delete" function to remove the data from the main index.

Now I dont get any data from the appliances anymore and I've no idea why..

Maybe someone can give me a hint whats the problem of my config?

woodcock — Fri, 01 Apr 2016 14:54:14 GMT

Did you configure the securitylogs index in indexes.conf on all of your indexers (and then restart them)?

nicocin — Tue, 29 Sep 2020 09:17:14 GMT

It is configured in the app config_all_indexers which is deployed to all indexers.

I've restarted splunkd on all indexers.

niemesrw — Sat, 02 Apr 2016 16:41:12 GMT

It sounds like you have it configured properly. I'd take the following steps to troubleshoot what might be going on:

Run tcpdump on the indexer where you have that input & index configured, do you see traffic making its way to that indexer?
Run netstat -an | grep 3514 on the indexer to ensure the port is open & listening
Examine the securitylogs index to ensure it's growing
Run index=* source="tcp:3514" to see if it's going to a different index (you may want to run it on the search heads & the indexers)
Run index=_internal and search for anything relating to the cooked logs or a host configured to send logs to your indexers

nicocin — Mon, 04 Apr 2016 07:03:52 GMT

Thank you for the tips.

I've changed nothing but now I'm receiving events.

Unfortunately they go to the main index..

How can I change that?

nicocin — Tue, 29 Sep 2020 09:17:31 GMT

I've found another article that states "The "splunktcp" input is not a data input, but instead an input to listen to Splunk Forwarders."

So I've configured it with props.conf and transforms.conf:

props.conf
[mc_logs]
TRANSFORMS-index=sendtomyindex

transforms.conf
[sendtomyindex]
SOURCE_KEY=_MetaData:Index
DEST_KEY=_MetaData:Index
REGEX=(.*)
FORMAT=securitylogs

Now the data goes to the index "securitylogs".