Send only few events

[andreas_linden]

Hello Splunk Support,

we have the following problem:
- We must send a log file to different receiver:
-- a Splunk server and the splunk server need ALL events
-- a non-splunk server, but only few events, so a whitelisting solution

I found the following documentation
https://answers.splunk.com/answers/9076/how-to-configure-a-forwarder-to-filter-and-send-only-the-eve...

Now my questions:
- Could I combine both solution – all events to one server and few events to another server??

[DMohn]

Yes, that would be possible if you use a Heavy Forwarder for that. The feature you are looking for is called "Event Routing"

You need to configure both servers in the outputs.conf of your forwarder, one as tcpout (for the Splunk Server), and one as syslog output (for the non-splunk server)

[tcpout:splunkindexer]
disabled = false
server = ip.of.ind.exr

[syslog:syslogout]
server = ip.of.sys.log:514
type = udp

Then you need to adjust the props.conf of the respective source or sourcetype

[yoursourcetype]
TRANSFORMS-routing = routeAll, routeSubset

Finally, create a transforms.conf that does the filtering and routing

[routeAll]
REGEX=(.)
DEST_KEY=_TCP_ROUTING
FORMAT=splunkindexer

[routeSubset]
REGEX=(your_regex_to_filter)
DEST_KEY=_TCP_ROUTING
FORMAT=splunkindexer,syslogout

Please refer to the splunk docs for details: https://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Routeandfilterdatad#Replicate_a_subse...