Forward subset of logs via _TCP_ROUTING

[sonicZ]

Using a heavy forwarder I'm having some issues using the _TCP_ROUTING examples posted in splunk docs and some splunk base answers.
I am just trying to forward a specific sourcetype log type to another forwarder, Is this correct or is there anything i am doing wrong?

in props.conf
[somesourcetype]
TRANSFORMS-log_subset = some_logs

In transforms.conf
[some_logs]
REGEX = .
DEST_KEY=_TCP_ROUTING
FORMAT=some_logs_subset

In outputs.conf
[tcpout:some_logs_subset]
server=serverip:port

[Drainy]

Your config looks fine to me.

Have you correctly defined the input on the other side and tested connectivity?

[sonicZ]

Also another oddity is if i specify
[tcp://9997]
instead of splunktcp the data comes in indexed but since its still coming in cooked.

--splunk-cooked-mode-v3--\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00 etc...

So connectivity seems fine just seems like this instance is not handling cooked "spunktcp" data correctly.

[sonicZ]

I should also mention this is a spunk 4.3.3 instance forwarding to splunk 5.0.3

[sonicZ]

I basically just have this on the receiving forwarder
connectivity is fine in splunkd logs from forwarder to forwarder and via port connect tests(telnet)

[splunktcp://9997]
connection_host = dns
index = iseclog_core
sourcetype = logger_cef

[lmyrefelt]

you can do it with a combination of inputs and outputs.

inputs.conf

[monitor:///some/path/to/some/files/]
_TCP_ROUTING = my_new_route
source =
sourcetype =
host =
blacklist =

outputs.conf

[tcpout]
defaultGroup = our_default_route

[tcpout:out_default_route]
server = 0.0.0.0:0000

[tcpout:our_new_route]
server = 1.1.1.1:1111

[sonicZ]

This is a heavy forwarder receiving multiple inputs on different ports, so i am using props and transforms .conf files specified in original post.

[lmyrefelt]

what kind of forwarder are you using? Can it be that you need another kind of forwarder (ie. heavy) to what u want?

[sonicZ]

The only problem i have is we have an input on
[splunktcp:port]

That basically has a lot of data coming in from, the sourcetype is mixed in with that data so we only want to forward data that is of that particular sourcetype, preferably not changing the inputs.conf ports