Getting Data In
Highlighted

How to configure a heavy forwarder to route some of the data to syslog+nullqueue, and rest to index?

Path Finder

We are trying to configure a heavy forwarder to route some of the data to syslog+nullqueue, and index the rest of the data.

I tried to use props + transforms to route the desired regex to syslog+null queue.
Issue is, when events go to nullqueue, they do not go to syslog at all.
Is there any way to send to syslog while not indexing?

Here is what I configured in props.conf, transforms.conf:

Sourcetype: BES
Regex to route to syslog: *INFO
All the other events should be indexed.

props.conf
[BES]
TRANSFORMS-bes-syslog=sendtosyslogbes,nullqueuebes

transforms.conf
[nullqueuebes]
REGEX = *INFO
DEST
KEY = queue
FORMAT = nullQueue

[sendtosyslogbes]
REGEX = *INFO
DEST
KEY = SYSLOGROUTING
FORMAT = syslogforward_bes

outputs.conf
[tcpout]
defaultGroup = default-autolb-group

[tcpout-server://indexer01:9997]

[tcpout-server://indexer02:9997]

[tcpout:default-autolb-group]
disabled = false
server = indexer01:9997,indexer02:9997

[syslog:syslogforward_bes]
server = x.x.x.x:523
timestampformat = %Y-%m-%dT%H:%M:%S.%3N

0 Karma
Highlighted

Re: How to configure a heavy forwarder to route some of the data to syslog+nullqueue, and rest to index?

SplunkTrust
SplunkTrust

Youll want to use these in inputs.conf:

SYSLOGROUTING = primarySyslogs
TCPROUTING = somethingThatDoesntExistInOutputsConf

And then you'll have something like this in your outputs.conf:

[syslog]
defaultGroup=primarySyslogs

[syslog:primarySyslogs]
server = 10.1.1.197:514

https://answers.splunk.com/answers/54086/inputs-conf-syslog-routing-only.html

Your configuration may need to vary slightly. Perhaps you want specific events sent to syslog, others indexed, etc. I recommend that you read the docs very carefully and test before implementing in production if possible:

http://docs.splunk.com/Documentation/Splunk/6.2.0/Admin/Outputsconf
http://docs.splunk.com/Documentation/Splunk/6.2.0/Admin/Inputsconf

If you need to parse out specific events for syslog and index others,... you'll need to look into transforms.conf and props.conf as well

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.