Deployment Architecture

Sending Windows Eventlogs from splunk forwarder via a heavyforwarder to indexers

KulvinderSingh
Engager

hi All,

I need to send windows event logs from Splunkforwarder to Indexers via a heavyforwarder.

I have done some configuration but it seems like something is incorrect as I am getting cooked data in splunk instead of logs.

All the help is appreciated.

 

regards,

 

Labels (3)
0 Karma
1 Solution

PickleRick
Ultra Champion

You have tcp: on HF, as I said. You need to send from UF to HF on splunktcp input.

View solution in original post

0 Karma

KulvinderSingh
Engager

Splunk forwarder: outputs.conf

[tcpout]
defaultGroup=xxxhf

 

[tcpout:xxxhf]
autoLBFrequency=40
server=x.x.x.x:xxxx
useACK=true
indexandforward=false

 

Heavy forwarder : inputs.conf

[tcp://xxxxx]

sourcetype=WinEventLog
index=xxxxx
disabled = 0

inputs on indexers : 

[splunktcp:xxxx]

0 Karma

PickleRick
Ultra Champion

You have tcp: on HF, as I said. You need to send from UF to HF on splunktcp input.

0 Karma

KulvinderSingh
Engager

Okay got it, I have changed it to splunktcp on forwarder and even I can read the logs in splunk SH but still sourcetype of logs is coming in as xmlWinEventlog instead of WinEventLog. I have the SpluK_TA_Windows on indexers as well as on HF and SF. But this I think is close to resolving the issue if i can just sort this small thing.

0 Karma

PickleRick
Ultra Champion

You define the sourcetype and whether you want the events rendered as xml or in "old format" in inputs.conf

0 Karma

KulvinderSingh
Engager

so you mean to say in splunkforwarder inputs.conf i should set renderXML = false and that should fix it or will i have to do that everywhere like on SF,HF,IX all 3 places? sorry doing this for the first time. Getting windows logs is easiest of all but the way i am trying its looking very difficult.

 

thanks in advance.

0 Karma

PickleRick
Ultra Champion

OK. Baby steps 🙂

In the inputs.conf file on the UF you set how you want the events from the EventLog pulled - as XML or not.

Then you send it to HF, which sends data to indexer(s).

The app installed on the SH-s are responsible for search-time extractions.

I don't remember if the TA for windows does any index-time data modifications - you have to check the docs. If it does, you'd also need it on the HF. But I don't recall installing it there.

0 Karma

PickleRick
Ultra Champion

We don't know your config but I'd dare to guess that you're sending to tcp: input instead of splunktcp: one.

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...