Getting Data In

Can I route some data as syslog output to multiple destinations?

Dan
Splunk Employee
Splunk Employee

I am indexing data feeds A and B and want to forward just data from B as syslog to servers X and Y (cloning the data stream). How can I do this?

1 Solution

Dan
Splunk Employee
Splunk Employee

Here is an example config that accomplishes this. I would recommend reading: http://www.splunk.com/base/Documentation/latest/Admin/Configureforwarderswithoutputs.conf

outputs.conf

[syslog]
defaultGroup=nothing
indexAndForward=true

[syslog:serverX]
server = beefysup01:514

[syslog:serverY]
server = 10.1.12.10:514

Note: By default, all events will get sent to all configured target groups. To avoid this, you need to set defaultGroup=nothing ("nothing" can be any name that is not defined as a target group). Then you manually route data to the targets using props and transforms.

props.conf

[source::B]
TRANSFORMS-routing=syslogRouting

Note: This is an example of why you should receive different types of network inputs on different ports. If data feeds A and B were different kinds of syslog (say router data and proxy data), and if both were received on default syslog port 514, then you would have a hard time separating A from B.

transforms.conf

[syslogRouting]
REGEX=.
DEST_KEY=_SYSLOG_ROUTING
FORMAT=serverX,serverY

Note: FORMAT is a comma separated list of target groups, which results in cloning of the data.

View solution in original post

gkanapathy
Splunk Employee
Splunk Employee

I believe that this could be more efficiently accomplished this way, assuming feed A comes in in port 1500, and B comes in on port 1600:

inputs.conf:

[udp:1500]
_SYSLOG_ROUTING = nothing

[udp:1600]
_SYSLOG_ROUTING = serverX,serverY

outputs.conf:

[syslog]
defaultGroup = none

[serverX]
server = x:1234
[serverY]
server = y:1234

Dan
Splunk Employee
Splunk Employee

I think you can only set _TCPOUT_ROUTING in inputs.conf

0 Karma

Dan
Splunk Employee
Splunk Employee

Here is an example config that accomplishes this. I would recommend reading: http://www.splunk.com/base/Documentation/latest/Admin/Configureforwarderswithoutputs.conf

outputs.conf

[syslog]
defaultGroup=nothing
indexAndForward=true

[syslog:serverX]
server = beefysup01:514

[syslog:serverY]
server = 10.1.12.10:514

Note: By default, all events will get sent to all configured target groups. To avoid this, you need to set defaultGroup=nothing ("nothing" can be any name that is not defined as a target group). Then you manually route data to the targets using props and transforms.

props.conf

[source::B]
TRANSFORMS-routing=syslogRouting

Note: This is an example of why you should receive different types of network inputs on different ports. If data feeds A and B were different kinds of syslog (say router data and proxy data), and if both were received on default syslog port 514, then you would have a hard time separating A from B.

transforms.conf

[syslogRouting]
REGEX=.
DEST_KEY=_SYSLOG_ROUTING
FORMAT=serverX,serverY

Note: FORMAT is a comma separated list of target groups, which results in cloning of the data.

Get Updates on the Splunk Community!

Unlock New Opportunities with Splunk Education: Explore Our Latest Courses!

At Splunk Education, we’re dedicated to providing top-tier learning experiences that cater to every skill ...

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...