How to edit my configurations to forward syslog to a third party using a Heavy Forwarder?

[rgb22]

Hello guys,

today i was able to send some syslogs to another non-Splunk instance, however when i tried to send 1 type of sourcetype i failed hard.

These are my outputs.conf, props.conf and transforms.conf and i really have no idea why isn't working. Maybe it's something really simple but i can't figure out what is it.

outputs.conf

[syslog]
defaultGroup = syslogGroup

[syslog:syslogGroup]
server = dest ip:5146

props.conf

[sourcetype::WinEventLog:Security]
TRANSFORMS-mcafee = send_to_syslog

transforms.conf

[send_to_syslog]
REGEX = .
DEST_KEY = _SYSLOG_ROUTING
FORMAT = syslogGroup

Any kind of help would be appreciate.

[somesoni2]

You specify sourcetype without any prefix in props.conf (prefix only needed for source and host), so update your props.conf entry with this

props.conf

[WinEventLog:Security]
 TRANSFORMS-mcafee = send_to_syslog

[rgb22]

i made a mistake, it was supose to be WinEventLog:Security instead of fgt_traffic

[mhassan05]

How to verify that it is actually working?

[rgb22]

Thanks for your answer, i made this modification and the problem persists. I tried to use " syslogSourceType = sourcetype::fgt_traffic" at output.conf but it didnt work either.