How can I escape linefeed/newline characters when forwarding Windows events to a third party via syslog?

[ringm]

Windows event logs are being picked up by Universal Forwarder v5 and sent to an Indexer v5.

I'm trying to forward these events to a third party for analysis. I've followed the instructions here and have events hitting my third party server on UDP 514.

Tcpdump shows the data contains newline characters. For example: ...\nLogName=Security\nSourceName=Security\n

It appears that UF picks up the newlines from the windows event log, and the built-in sourcetype creates multi-line events. But my third party server does not handle multi-line events in syslog correctly.

Is there any way to have Splunk escape/replace the newlines in the event with some other character or pattern prior to sending them to the third party over syslog?

[yannK · Accepted solution]

The windows events logs are multiline events in Splunk.

There are no method to format the events when they are being forwarded. So the only options are :

• bypass splunk
  collect the windows logs as syslog and send them directly to your device. (see snare and other tools)

• format the events at indextime using SEDCMD.
  Collect the events with splunk, and remove the linebreaking characters at index time.
  The events will be forwarded as single line.
  But in splunk, they will lose the default formatting, and some field extractions may fail.
  It will have a performance cost at index time to apply the sed command.

Disclaimer : This method is a workaround and the events may not be suitable for splunk existing apps and analytics.

Here is a method in props.conf for the indexers (and heavy forwarder) to achieve it for every windows events logs.

[source::*WinEventLog*]
SEDCMD= s/[\n\r]/ /g
# remove all the line breaks


[yannK]

thanks jrod, answer edited

[jrodman]

Snark alert! The + on the [class] is unnecessary.