Forward logs to third party and no duplicates in splunk

[Anto]

I want to forward logs to third party system (syslog) without index these data into splunk but i can't accomplish it, help.

On my heavy forwarder i set up outputs.conf, transforms.conf, props.conf as follow:

outuputs.conf

[syslog:my_syslog_group]
server = <IP>:PORT

transforms.conf

[send_to_syslog]
REGEX = MY REGEX
DEST_KEY = _SYSLOG_ROUTING
FORMAT = my_syslog_group

[not_send_to_syslog]
REGEX = MY REGEX
DEST_KEY =queue
FORMAT =nullQueue

props.conf

[source::MY_SOURCE]
TRANSFORMS-t0=send_to_syslog,not_send_to_syslog


In this way logs don't forward to my syslog, they will be just deleted and not indexed. Removing [not_send_to_syslog] from props and transforms data will be indexed on splunk and also forwarded to syslog.

How can i achieve my problem, sending data to syslog and not indexing them on splunk? Thanks in advantage to those who will help me.

[Anto · Accepted solution]

I find out the solution. In the transform.conf just replace DEST_KEY as follow:

[not_send_to_syslog]
REGEX = MY REGEX
DEST_KEY =_TCP_ROUTING
FORMAT =nullQueue

All done now. thanks to all

[scelikok]

Hi @Anto,

Can you try changing the order of transforms in props.conf

[source::MY_SOURCE]
TRANSFORMS-t0=not_send_to_syslog, send_to_syslog

[Anto]

Thank you for your answer but it didn't help. Logs aren't forwarded to syslog and they entered in nullqueue so i don't saw them also in splunk. Any other ideas?

[richgalloway]

What's the point of sending data to Splunk if it won't be indexed?  Send the syslog data directly to the syslog server.

[anilkapoor123]

Hi ,

plese help , how can i send data directly to  remote system , or syslog without indexing.

please provide the config settings for inputs.conf, outputs.conf, props.conf , transforms.conf

you help is appreciated.

thanks

[PickleRick]

1. This thread is over two years old. It's usually better to start a new one instead of digging up such antiquities. Possibly linking to the old one for reference what you already found.

2. You already had a solution in this thread.

3. If you don't want to use the data in Splunk in any way why send it there in the first place? It seems to make more sense to send it directly to the destination system.

[anilkapoor123]

@PickleRick 

without forwarding data to splunk heavy forwarder i cannot send to syslog server 

do you have any alernative for this like to 

forward ftop logs from window directory to syslog server without using splunk 

[PickleRick]

If you just want to pick up log files from local directory on windows computer and send the events from them to a syslog destination, use a syslog daemon for windows (Like NXLog, or Kiwi).

[richgalloway]

This thread is two years old with an accepted answer.  For better chances at getting an answer, please post a new question.

[Anto]

Because i don't need them for the analysis in Splunk but i want to preserve the logs  without exceed my license just for 2 GB. So you are telling me that this isn't possible to do directly from splunk? Thank you for your reply, i want just to understand