Getting Data In

Forwarding to a third party syslog server based on both host, sourcetype and regex

edoardo_vicendo
Contributor

We have to forward some data from a Splunk Heavy Forwarder to a third party syslog server.

This is possible as indicated here:

https://docs.splunk.com/Documentation/Splunk/8.0.6/Forwarding/Forwarddatatothird-partysystemsd

 

The challenge is to select only some files from a particular host and forward only the logs that contain a particular string.

Here is what we were able to achieve (basically 2 rules out of 3, so some files that contain a particular string), I don’t know if it is possible to add in some way a reference also for the host.

Do you know if it is feasible?

 

outputs.conf
[syslog:syslog_target]
type = udp
server = 111.222.333.444:514

props.conf
[source::/path/of/myfile/*filename.log]
TRANSFORMS-syslog_forward = syslog_forward_rule

transforms.conf
[syslog_forward_rule]
REGEX = www\.mywebsite\.com
DEST_KEY = _SYSLOG_ROUTING
FORMAT = syslog_target

 

Thanks a lot,

Edoardo

0 Karma
1 Solution

edoardo_vicendo
Contributor

@thambisetty Thanks for your feedback.
Basically there is no way to use host sourcetype and regex all together, unless you have the host:

  • in the event itself (that is not our case) --> so that you can filter with the REGEX in the transforms.conf
  • in the path name (that is not our case as well) --> so that you can directly filter in source stanza in props.conf

View solution in original post

0 Karma

thambisetty
SplunkTrust
SplunkTrust

I don’t think you can make use of host and source combinations in single props stanza.

if source specified in props matches events coming from those hosts you want to include and event contains host value then you can modify your regex in transforms to identify events you want to forward to syslog.

————————————
If this helps, give a like below.

edoardo_vicendo
Contributor

@thambisetty Thanks for your feedback.
Basically there is no way to use host sourcetype and regex all together, unless you have the host:

  • in the event itself (that is not our case) --> so that you can filter with the REGEX in the transforms.conf
  • in the path name (that is not our case as well) --> so that you can directly filter in source stanza in props.conf
0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...