Deployment Architecture

How to configure Splunk to collect syslog and forward the raw data to a 3rd party SIEM directly from a clustered indexer?

scorpia
New Member

Hello

We have 2 Data Center locations and each location has 3 indexers that collect logs from Universal Forwarders in each location. All indexers from the 2 DC locations are replicated for redundancy and Disaster Recovery purposes.

My questions:
1. Is it possible to forward all raw logs from all indexers to a 3rd party SIEM directly without a Heavy Forwarder?
2. Do I need to change props.conf and transforms.conf for each indexers or at Cluster Master?

We have Splunk 6.2.3

Thanks in advance.

0 Karma
1 Solution

jensonthottian
Contributor

Your questions:
1. Is it possible to forward all raw logs from all indexers to a 3rd party SIEM directly without a Heavy Forwarder? - Yes it is possible .Because they are forwarding to a non-Splunk system, they can send only raw data.

e.g.
outputs.conf

[syslog:webreports_syslog_group]
server = myhostname:514
type = tcp

transforms.conf
[send_to_webreports]
REGEX = .
DEST_KEY = _SYSLOG_ROUTING
FORMAT = webreports_syslog_group

props.conf:

[source::/data/logs/httpd/somesite/access*]
TRANSFORMS-weblog-matrix = send_to_webreports

  1. Do I need to change props.conf and transforms.conf for each indexers or at Cluster Master? In each indexer for the sources you want to send.

View solution in original post

0 Karma

jensonthottian
Contributor

Your questions:
1. Is it possible to forward all raw logs from all indexers to a 3rd party SIEM directly without a Heavy Forwarder? - Yes it is possible .Because they are forwarding to a non-Splunk system, they can send only raw data.

e.g.
outputs.conf

[syslog:webreports_syslog_group]
server = myhostname:514
type = tcp

transforms.conf
[send_to_webreports]
REGEX = .
DEST_KEY = _SYSLOG_ROUTING
FORMAT = webreports_syslog_group

props.conf:

[source::/data/logs/httpd/somesite/access*]
TRANSFORMS-weblog-matrix = send_to_webreports

  1. Do I need to change props.conf and transforms.conf for each indexers or at Cluster Master? In each indexer for the sources you want to send.
0 Karma

cleelakrishna
Loves-to-Learn

I'm unable forward specific INDIEX from HF to syslog . please check the configurations which I have used
props.conf
[index::watson]
TRANSFORMS-watson = wat_to_syslog

transforms.conf
[wat_to_syslog]
REGEX = .
DEST_KEY = _SYSLOG_ROUTING
FORMAT = wat_syslog_group

outputs.conf

[syslog:wat_syslog_group]
server = splunk-syslog.XXXX.com:514
type=udp

0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...