Add static string or sourcetype to event before forwarding to 3rd party syslog server

[smith91]

We have a Splunk Enterprise (single instance) and collect logs from all network devices and operating systems, recently we have to send all logs as syslog to a 3rd party syslog-server so we configured transforms.conf, outputs.conf and props.conf and now every log are sending to that server.

But now we need to add SourceType of the event to the event's body in order to events be distinguishable at syslog server. For example we need to append "iis" to head of iis events or add "apache" to events with sourcetype of access_combined before sending to 3rd party syslog server.

There is no limitation in solution, we can add a fixed string for each sourcetype or exact sourcetype of the event to the event body.

Please help me to configure props, transforms and output files.

Here are my conf files:

props.conf

[WinEventLog:Security]
TRANSFORMS-WinEventLog=send_to_syslog

[WinEventLog:System]
TRANSFORMS-WinEventLog=send_to_syslog

...(other sourcetypes)

transforms.conf

[send_to_syslog]
REGEX = .
DEST_KEY = _SYSLOG_ROUTING
FORMAT = syslog_3rd

output.conf:

[syslog:syslog_3rd]
type = udp
server = 3rdPartyIP:514

[tcpout]
indexAndForward = 0

Thanks.

[tiagofbmm]

If you need the sourcetype there, it means the data will be sent after parsed. I'd go for the CEF output app that allows you to route Splunk parsed data to 3rd party tools with scheduled saved searches.

https://docs.splunk.com/Documentation/CEFapp/2.1.0/DeployCEFapp/Howtheappworks