This question is based off earlier questions, but I am looking for someone to confirm that the following conf is written correctly.
Reference link is
http://docs.splunk.com/Documentation/SplunkCloud/6.6.3/Forwarding/Routeandfilterdatad#Replicate_a_su...
Scenario:
I have a data source that I want to send to a Splunk Fwdr which will then fork ALL the cooked data to 1) my indexers (autoLB) AND 2) ALL the uncooked data to a thrid party TCP listener.
Here is what I have
Edit $SPLUNK_HOME/etc/system/local/props.conf
[syslog]
TRANSFORMS-routing = routeAll, routeSubset
Edit $SPLUNK_HOME/etc/system/local/transforms.conf
[routeAll]
REGEX=(.) <-------- This specifies all data goes to the indexer
DEST_KEY=_TCP_ROUTING
FORMAT=Everything <-------- This specifies all data goes to the indexer
[routeSubset]
REGEX=(.) <--------- This is specifies all data would go to the 3rd party tcp listener
DEST_KEY=_TCP_ROUTING
FORMAT=Subsidiary < ----------------- This specifies that all data would go to the 3rd party TCP receiver as "subsidiary"
Edit $SPLUNK_HOME/etc/system/local/outputs.conf
[tcpout]
defaultGroup=nothing
[tcpout:Everything]
disabled=false
server=x.x.x.x:9997 <---- my splunk indexer
[tcpout:Subsidiary]
disabled=false
sendCookedData=false
server=x.x.x.x:1234 <---- the 3rd party app tcp receiver
however is there a simpler way to write this? I just don't know of a way to say "uncooked to 3rd party" and "cooked to indexers" in one stanza?
Thank you
The TRANSFORM routeSubset
will be executed first and will send all data to 3rd party TCP receiver. Thus no events will go to your indexer. Since you want to clone the data for syslog, try something like this
Edit $SPLUNK_HOME/etc/system/local/props.conf
[syslog]
TRANSFORMS-routing = cloneAll
Edit $SPLUNK_HOME/etc/system/local/transforms.conf
[cloneAll]
REGEX=(.)
DEST_KEY=_TCP_ROUTING
FORMAT=Everything,Subsidiary <-------- This specifies all data goes to both indexer and Subsidiary
No change to outputs.conf
The TRANSFORM routeSubset
will be executed first and will send all data to 3rd party TCP receiver. Thus no events will go to your indexer. Since you want to clone the data for syslog, try something like this
Edit $SPLUNK_HOME/etc/system/local/props.conf
[syslog]
TRANSFORMS-routing = cloneAll
Edit $SPLUNK_HOME/etc/system/local/transforms.conf
[cloneAll]
REGEX=(.)
DEST_KEY=_TCP_ROUTING
FORMAT=Everything,Subsidiary <-------- This specifies all data goes to both indexer and Subsidiary
No change to outputs.conf
Thank you I will test it and let you know.
so this is what I am going to test, fyi, hopefully I wrote it correctly
Edit $SPLUNK_HOME/etc/system/local/props.conf
[syslog]
TRANSFORMS-routing = cloneAll
Edit $SPLUNK_HOME/etc/system/local/transforms.conf
[cloneAll]
REGEX=(.)
DEST_KEY=_TCP_ROUTING
FORMAT=Everything,Subsidiary
Edit $SPLUNK_HOME/etc/system/local/outputs.conf
[tcpout]
defaultGroup=nothing
[tcpout:Everything]
disabled=false
server=x.x.x.x:9997 <---- my splunk indexer
[tcpout:Subsidiary]
disabled=false
sendCookedData=false
server=x.x.x.x:1234 <---- the 3rd party app tcp receiver