Getting Data In

Heavy Forwarded Filtering Hosts

ericl42
Path Finder

Hello,

I've ready a ton of forums posts regarding this but I still cannot get it to work so I'm hoping someone could point out what I'm doing wrong.

The scenario I have is there are multiple hosts with the Splunk agent installed on it and we're currently logging that data to our Splunk indexers + a syslog server. For a short period of time, I want to send a subset of logs only to syslog but I can't seem to get that to work.

Below is my current config on my heavy forwarders. I expect this to send all hosts with server* to Splunk and syslog but only endpoint* to syslog.

Right now no matter what I do, everything still goes to Splunk. I even fully commented out the routeSubset section and "splunk reload deploy-server" and I still got those logs in Splunk

Any thoughts would be greatly appreciated.

props.conf
[source::WinEventLog:Security]
TRUNCATE = 0
SEDCMD-win = s/(?mis)(Token\sElevation\sType\sindicates|This\sevent\sis\sgenerated).*$//g
TRANSFORMS-routing = routeSubset, routeSubset2

transforms.conf

[routeSubset]
SOURCE_KEY=MetaData:Host
REGEX=(?i)^server[0-9][0-9].*
DEST_KEY=_TCP_ROUTING
FORMAT=splunkssl

[routeSubset2]
SOURCE_KEY=MetaData:Host
REGEX=(?i)(.*endpoint[0-9][0-9].*|^server[0-9][0-9].*)
DEST_KEY=_SYSLOG_ROUTING
FORMAT=syslog_server

Labels (1)
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...