topic Re: How can I pipe search results to syslog? in Splunk Search

How can I pipe search results to syslog?

grantsales — Thu, 12 Feb 2015 21:08:06 GMT

Example:

I'd like to run a search on windows logs, do some data transformation and then pipe the output to a syslog listener not on the local host.

sourcetype="WinEventLog:Security" EventCode=4624 Logon_Type=2 |  Send to syslog IP 10.0.0.12:514

Re: How can I pipe search results to syslog?

dart — Fri, 13 Feb 2015 15:17:03 GMT

The Splunk App for CEF demonstrates one way of doing this.

Re: How can I pipe search results to syslog?

grantsales — Tue, 24 Feb 2015 19:40:02 GMT

Thanks, but I am looking for an alternative to this app.

My current tools are limited to "Searching and Reporting" App and any python scripts I can put on the server.

Re: How can I pipe search results to syslog?

MuS — Tue, 24 Feb 2015 19:54:21 GMT

This maybe sounds strange in the first place; but how about using the route and filter method in props.conf like written in the docs http://docs.splunk.com/Documentation/Splunk/6.2.1/Forwarding/Routeandfilterdatad#Replicate_a_subset_of_data_to_a_third-party_system
Use as regex something like this REGEX = .+EventCode=4624.+Logon_Type=2 and set it on the sourcetype [WinEventLog:Security]

Re: How can I pipe search results to syslog?

grantsales — Tue, 24 Feb 2015 21:01:22 GMT

I didn't even know you could do that, it's possible that it could work, my fields are using the Windows app for splunk so I'm not sure if I'd be able to use that regex. Thanks for the tip.