Getting Data In

Heavy Forwarded Filtering Hosts

ericl42
Path Finder

Hello,

I've ready a ton of forums posts regarding this but I still cannot get it to work so I'm hoping someone could point out what I'm doing wrong.

The scenario I have is there are multiple hosts with the Splunk agent installed on it and we're currently logging that data to our Splunk indexers + a syslog server. For a short period of time, I want to send a subset of logs only to syslog but I can't seem to get that to work.

Below is my current config on my heavy forwarders. I expect this to send all hosts with server* to Splunk and syslog but only endpoint* to syslog.

Right now no matter what I do, everything still goes to Splunk. I even fully commented out the routeSubset section and "splunk reload deploy-server" and I still got those logs in Splunk

Any thoughts would be greatly appreciated.

props.conf
[source::WinEventLog:Security]
TRUNCATE = 0
SEDCMD-win = s/(?mis)(Token\sElevation\sType\sindicates|This\sevent\sis\sgenerated).*$//g
TRANSFORMS-routing = routeSubset, routeSubset2

transforms.conf

[routeSubset]
SOURCE_KEY=MetaData:Host
REGEX=(?i)^server[0-9][0-9].*
DEST_KEY=_TCP_ROUTING
FORMAT=splunkssl

[routeSubset2]
SOURCE_KEY=MetaData:Host
REGEX=(?i)(.*endpoint[0-9][0-9].*|^server[0-9][0-9].*)
DEST_KEY=_SYSLOG_ROUTING
FORMAT=syslog_server

Labels (1)
0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.