Getting Data In

Forward filtered logs to indexer and full logs to third party syslog server

archme
Explorer

Hello,

I am currently forwarding logs from uf to HF to idx.

What I am trying to achieve is drop windows event with the event code 4674 for example from being sent to idx. At the same time, forward all the logs including the events with the event code 4674 to a 3rd party syslog server from the HF.

While configuring the HF, I found:
1) there is a delay in sending the logs to syslog server. I noticed that I received it roughly 15 minutes after the event time.
2) I configured the event code 4674 to send to nullqueue. By doing so, it dropped the event from being sent to idx. However, it is also not forwarding this event to the 3rd party syslog server. I need it only drop the events from being sent to idx. It has to send this event to the syslog server.

Not sure what is wrong..hope someone can advise.

Below is my outputs.conf setting:

[tcpout]
defaultGroup = primary_indexers
[syslog]
defaultGroup = EverythingtoSSB
[syslog:EverythingtoSSB]
#sendCookedData=false
server=1.2.3.4:514
type=udp
maxEventSize=5096

Below is props.conf:

[WinEventLog:Security]
TRANSFORMS-set=wineventlog-setnull,routeAlltoSSB

Below is transforms.conf

[routeAlltoSSB]
REGEX=(.)
DEST_KEY=_SYSLOG_ROUTING
FORMAT=EverythingtoSSB

[wineventlog-setnull]
REGEX=(?m)^EventCode=(4674)
DEST_KEY = queue
FORMAT = nullQueue
0 Karma

somesoni2
SplunkTrust
SplunkTrust

Try this for your Below for transforms.conf

[routeAlltoSSB]
 REGEX=(.)
 DEST_KEY=_TCP_ROUTING
 FORMAT=EverythingtoSSB,primary_indexers

 [wineventlog-setnull]
 REGEX=(?m)^EventCode=(4674)
 DEST_KEY=_TCP_ROUTING
 FORMAT = EverythingtoSSB
0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Using the Splunk Threat Research Team’s Latest Security Content

REGISTER HERE Tech Talk | Security Edition Did you know the Splunk Threat Research Team regularly releases ...

SplunkTrust | 2024 SplunkTrust Application Period is Open!

It's that time again, folks! That's right, the application/nomination period for the 2024 SplunkTrust is ...