Hi ,
I am trying to forward some live apache logs from splunk forwarder to third party tool with below settings.
Outputs.conf
[tcpout:1]
server = 172.17.8.178:5555
sendCookedData = false
I am unable to receive logs , found below error on splunkd.log
01-25-2016 14:24:02.203 +0530 INFO TcpOutputProc - Removing quarantine from idx=172.17.8.178:5555
01-25-2016 14:24:02.205 +0530 INFO TcpOutputProc - Connected to idx=172.17.8.178:5555
01-25-2016 14:24:02.237 +0530 ERROR TcpOutputFd - Read error. Connection reset by peer
01-25-2016 14:24:02.237 +0530 INFO TcpOutputProc - Connection to 172.17.8.178:5555 closed. Read error. Connection reset by peer
01-25-2016 14:24:02.433 +0530 INFO TcpOutputProc - Connected to idx=172.17.8.178:5555
01-25-2016 14:24:02.488 +0530 ERROR TcpOutputFd - Read error. Connection reset by peer
01-25-2016 14:24:02.488 +0530 INFO TcpOutputProc - Connection to 172.17.8.178:5555 closed. Read error. Connection reset by peer
01-25-2016 14:24:02.488 +0530 WARN TcpOutputProc - Applying quarantine to ip=172.17.8.178 port=5555 _numberOfFailures=2
Can any one help on this.
You can't use tcpout to send to a 3rd party tool as that tool does not recognize the splunk tcp protocol. If you want to forward data to a 3rd party system you are going to have to use syslog.
Here's some samples:
outputs.conf
[syslog:third_party]
server = 10.37.7.44:4444
type= tcp
maxEventSize = 38000
Note the maxEventSize - you may not need it that large.
You'll also need a props.conf and transforms.conf to select what data to send:
props.conf
[apache]
TRANSFORMS-send_syslog=to_syslog
transforms.conf
[to_syslog]
REGEX = .*
DEST_KEY = _SYSLOG_ROUTING
FORMAT = third_party
You can't use tcpout to send to a 3rd party tool as that tool does not recognize the splunk tcp protocol. If you want to forward data to a 3rd party system you are going to have to use syslog.
Here's some samples:
outputs.conf
[syslog:third_party]
server = 10.37.7.44:4444
type= tcp
maxEventSize = 38000
Note the maxEventSize - you may not need it that large.
You'll also need a props.conf and transforms.conf to select what data to send:
props.conf
[apache]
TRANSFORMS-send_syslog=to_syslog
transforms.conf
[to_syslog]
REGEX = .*
DEST_KEY = _SYSLOG_ROUTING
FORMAT = third_party