Using splunk forwarder for forwarding logs to third party tool

[vranjith009]

Hi ,

I am trying to forward some live apache logs from splunk forwarder to third party tool with below settings.
Outputs.conf
[tcpout:1]
server = 172.17.8.178:5555
sendCookedData = false

I am unable to receive logs , found below error on splunkd.log

01-25-2016 14:24:02.203 +0530 INFO TcpOutputProc - Removing quarantine from idx=172.17.8.178:5555
01-25-2016 14:24:02.205 +0530 INFO TcpOutputProc - Connected to idx=172.17.8.178:5555
01-25-2016 14:24:02.237 +0530 ERROR TcpOutputFd - Read error. Connection reset by peer
01-25-2016 14:24:02.237 +0530 INFO TcpOutputProc - Connection to 172.17.8.178:5555 closed. Read error. Connection reset by peer
01-25-2016 14:24:02.433 +0530 INFO TcpOutputProc - Connected to idx=172.17.8.178:5555
01-25-2016 14:24:02.488 +0530 ERROR TcpOutputFd - Read error. Connection reset by peer
01-25-2016 14:24:02.488 +0530 INFO TcpOutputProc - Connection to 172.17.8.178:5555 closed. Read error. Connection reset by peer
01-25-2016 14:24:02.488 +0530 WARN TcpOutputProc - Applying quarantine to ip=172.17.8.178 port=5555 _numberOfFailures=2

Can any one help on this.

[sjohnson_splunk · Accepted solution]

You can't use tcpout to send to a 3rd party tool as that tool does not recognize the splunk tcp protocol. If you want to forward data to a 3rd party system you are going to have to use syslog.

Here's some samples:

outputs.conf

[syslog:third_party]
server = 10.37.7.44:4444
type= tcp
maxEventSize = 38000

Note the maxEventSize - you may not need it that large.

You'll also need a props.conf and transforms.conf to select what data to send:

props.conf

[apache]
TRANSFORMS-send_syslog=to_syslog

transforms.conf

[to_syslog]
REGEX = .*
DEST_KEY = _SYSLOG_ROUTING
FORMAT = third_party