Hello Splunk Support,
we have the following problem:
- We must send a log file to different receiver:
-- a Splunk server and the splunk server need ALL events
-- a non-splunk server, but only few events, so a whitelisting solution
I found the following documentation
https://answers.splunk.com/answers/9076/how-to-configure-a-forwarder-to-filter-and-send-only-the-eve...
Now my questions:
- Could I combine both solution – all events to one server and few events to another server??
Yes, that would be possible if you use a Heavy Forwarder for that. The feature you are looking for is called "Event Routing"
You need to configure both servers in the outputs.conf of your forwarder, one as tcpout (for the Splunk Server), and one as syslog output (for the non-splunk server)
[tcpout:splunkindexer]
disabled = false
server = ip.of.ind.exr
[syslog:syslogout]
server = ip.of.sys.log:514
type = udp
Then you need to adjust the props.conf of the respective source or sourcetype
[yoursourcetype]
TRANSFORMS-routing = routeAll, routeSubset
Finally, create a transforms.conf that does the filtering and routing
[routeAll]
REGEX=(.)
DEST_KEY=_TCP_ROUTING
FORMAT=splunkindexer
[routeSubset]
REGEX=(your_regex_to_filter)
DEST_KEY=_TCP_ROUTING
FORMAT=splunkindexer,syslogout
Please refer to the splunk docs for details: https://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Routeandfilterdatad#Replicate_a_subse...