topic Re: Splunk as syslog --> vbs script--> security device in Splunk Search

Splunk as syslog --> vbs script--> security device

flanny16 — Fri, 05 Apr 2013 17:29:17 GMT

Hello All,
I have setup splunk as a syslog receiver from a test wireless controller. this is working great.
Next, I have a vbs script that look for information in the syslog message, ie user.

I then want syslog to send that information to another device.

Questions:
a) if I define my vbs script under ...data inputs....scripts. Assuming the script is correctly written, parse the syslog information and send it to another security device?
b) Do I have to define a forwarder for this to work?

thank you all in advance,
GMF

Re: Splunk as syslog --> vbs script--> security device

sbrant_splunk — Sun, 07 Apr 2013 22:22:21 GMT

Here is an option, that is different from what you propose but potentially less complicated. There is an app on SplunkBase, called "Splunk Real-Time Output":

http://splunk-base.splunk.com/apps/48082/splunk-real-time-output

The app will allow you to create a search in Splunk, against the wireless controller data, that you are already collecting, and forward it via syslog (either UDP or TCP) to another device. This will eliminate the need to utilize vbscript and I suspect, be far easier to maintain.

Re: Splunk as syslog --> vbs script--> security device

flanny16 — Mon, 08 Apr 2013 15:14:32 GMT

Thank you for this.

I am not sure if our device that we are sending to from splunk will accept syslog info but I am testing out that theory. The other option is file but again, this is unknown. Will probe our vendor for support as well.

Nice app.

GMF