All Apps and Add-ons

How to configure Splunk For Symantec with a Splunk distributed architecture?

o_calmels
Communicator

Hi, I've just set up the Splunk For Symantec App in my distributed architecture.
On the forwarder, set an inputs.conf listening on port TCP 514 and forwarding data to index Symantec with sourcetype sep12:log

tcp://X.X.X.X:514]
connection_host = ip
index=symantec
sourcetype = sep12:log
disabled = 0

On each indexer (2 indexers)
set the sep12 TA

On my Search Head, installed the app and configured it to read data in index symantec

When I received data from SEPM, the data are indexed in index Symantec with sourcetype sep12:log.
The app is looking for sourcetypes like sep12:agent or sep12:policy Etc ... as they are defined in Props.conf and transform.conf.

I think field extraction is not running as desired.

Has somebody tried to use this app in a distributed environment ?

Thank's a lot.

Olivier.

1 Solution

o_calmels
Communicator

Hi, I finally found the solution:

The stage when the add-on modifies the sourcetype is during the parsing process (through props.conf and transforms.conf).
Détails herre ==> http://docs.splunk.com/Documentation/Splunk/6.2.1/Data/Advancedsourcetypeoverrides

My architecture has a universal forwarder and the parsing process is done only on indexers or heavy forwarder. So my universal forwarder sets a sourcetype during he tparsing stage, then forwards data to the indexers that index without any transformations.

The solution in this case is

  • install universal forwarder on my Windows SEPM server
  • configure SEPM to export logs as files (instead of syslog)
  • modify input.conf.local with SEPM install path

Hope that helps.

Olivier

View solution in original post

o_calmels
Communicator

Hi, I finally found the solution:

The stage when the add-on modifies the sourcetype is during the parsing process (through props.conf and transforms.conf).
Détails herre ==> http://docs.splunk.com/Documentation/Splunk/6.2.1/Data/Advancedsourcetypeoverrides

My architecture has a universal forwarder and the parsing process is done only on indexers or heavy forwarder. So my universal forwarder sets a sourcetype during he tparsing stage, then forwards data to the indexers that index without any transformations.

The solution in this case is

  • install universal forwarder on my Windows SEPM server
  • configure SEPM to export logs as files (instead of syslog)
  • modify input.conf.local with SEPM install path

Hope that helps.

Olivier

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...