Getting Data In

How to forward indexed data to another syslog server?

satishsdange
Builder

Hi Gang -

I know this question has been asked and answered several times, but I could not fix my problem. Could someone please help me out

root@ip-172-31-26-78:/opt/splunk/etc/system/local# cat inputs.conf
[monitor:///var/log/syslog]
host = splunk_indx
sourcetype = syslog
root@ip-172-31-26-78:/opt/splunk/etc/system/local# cat outputs.conf
[tcpout:syslog]
server = 54.169.86.31:514
sendCookedData = false


root@ip-172-31-26-78:/opt/splunk/etc/system/local# cat props.conf
[syslog]
TRANSFORMS-forward = syslogTcpOut
root@ip-172-31-26-78:/opt/splunk/etc/system/local# cat transforms.conf
[syslogTcpOut]
REGEX = .
DEST_KEY=_TCP_ROUTING
FORMAT=syslog
root@ip-172-31-26-78:/opt/splunk/etc/system/local#

BTW, I have referred this post https://answers.splunk.com/answers/65818/forward-data-to-a-third-party-system.html

Thank you so much!!!

0 Karma

jmallorquin
Builder

Hi satishsdange,

I recomend you to change this in your configuration

root@ip-172-31-26-78:/opt/splunk/etc/system/local# cat outputs.conf
 [tcpout:syslog_forward]
 server = 54.169.86.31:514
 sendCookedData = false


 root@ip-172-31-26-78:/opt/splunk/etc/system/local# cat transforms.conf
 [syslogTcpOut]
 REGEX = .
 DEST_KEY=_TCP_ROUTING
 FORMAT=syslog_forward

Hope i help you.

0 Karma

satishsdange
Builder

Unfortunately it did not work.

0 Karma

somesoni2
Revered Legend

The props and transforms should be in Heavy Forwarder/Indexers. It seems like you did all these on the forwarder itself. (read comment#4 on the reference answer)

0 Karma

satishsdange
Builder

Config is from indexer.

0 Karma

satishsdange
Builder

Any taker for this question?

0 Karma
Get Updates on the Splunk Community!

Full-Stack Security in Financial Services: AppDynamics, Cisco Secure Application, and ...

Full-Stack Security in Financial Services: AppDynamics, Cisco Secure Application, and Splunk ES Protecting a ...

It's Customer Success Time at .conf25

Hello Splunkers,   Ready for .conf25? The customer success and experience team is and can’t wait to see you ...

Pro Tips for First-Time .conf Attendees: Advice from SplunkTrust

Heading to your first .Conf? You’re in for an unforgettable ride — learning, networking, swag collecting, ...