Archive

How to edit outputs.conf for the Splunk Add-on for Check Point OPSEC LEA on a heavy forwarder to route logs to new indexers?

Path Finder

We have a Splunk setup to get the ASA Check Point logs collected to heavy forwarder and send to an indexer server through the Splunk® Add-on for Check Point OPSEC LEA. That add-on was configured and installed on the Heavy forwarder.

When I checked the input files, I see the following script was added in inputs.conf file
information /opt/splunk/etc/apps/SplunkTAopseclea_linux22/bin/lea-loggrabber.sh --configentity Checkpoint

Now we are in the process building new indexer servers and I'm trying to find the way to change the outputs.conf and redirect the logs to the new indexers.

Here is the current data flow.

Checkpoint ---- HF -- old indexer
My new settings will be
Check point - HF - new indexer servers --

If any one knows how to update the outputs Splunk Add-on for Check Point OPSEC LEA, please let me know.

0 Karma
1 Solution

Path Finder

some times we miss the basic things 🙂

I have found the way it is simple and it worked .

Thanks for your help

adding below stanza to inputs.conf

TCPROUTING = indexset

View solution in original post

0 Karma

Path Finder

some times we miss the basic things 🙂

I have found the way it is simple and it worked .

Thanks for your help

adding below stanza to inputs.conf

TCPROUTING = indexset

View solution in original post

0 Karma

Path Finder

Here is my inputs.conf in

Here is the inputs.conf file in my heavy forwarder
[script:///opt/splunk/etc/apps/SplunkTAopseclealinux22/bin/lea-loggrabber.sh --configentity CheckpointXX
_rcvbuf = 1572864
disabled = false
host = XX
index = firewall
interval = 10
passAuth = splunk-system-user
sourcetype = sec

0 Karma

Path Finder

I'm just trying to find way to redirect new data to new indexer server.
I don't need to reindex the old data.

0 Karma

Path Finder

But my case I want completely redirect from old to new indexers.

0 Karma

Splunk Employee
Splunk Employee

Do you want to move data previously indexed on old indexers to new indexers? Do you want to use both old indexers and new?

I am not familiar with redirecting from indexers to indexers, if anything - use existing forwarders and edit outputs.conf to forward to new indexers, which is what the link covers.

0 Karma