Getting Data In

How to index Windows event logs data and forward it to an external syslog server?

cburgman
Path Finder

I want to send Windows event log data from several domain controllers to Splunk to be indexed as well as an external syslog collector. I am currently receiving the logs in Splunk with no issues. The problem arises when I attempt to forward the WinEvent data to my syslog server. Once I enable the syslog service, I get flooded with all of my data being forwarded to the external collector. I only want the data from the domain controllers.

Nutshell:
-Windows data is being sent via a universal forwarder with no issues.
-The data (only Windows data) needs to be indexed and forwarded over to an external syslog collector.
-Created new outputs.conf, props.conf and transforms.conf to output data to external collector.
-When the syslog service is enabled it is flooded with ALL of the data being sent to Splunk.
-Syslog Server IP: xx.xx.xxx.xx
-Port: TCP 514
-Splunk Version 6.3.3

outputs.conf:

[syslog]
defaultGroup = SymantecMSS

[syslog:SymantecMSS]
server = xx.xx.xxx.xx:514
type = tcp
priority = <13>
timestampformat = %b %d %H:%M:%S
maxEventSize = 16384

props.conf:

[source::WinEventLog:*]
TRANSFORMS-WinEventLog=SymantecMSSStanza

transforms.conf:

[SymantecMSSStanza]

# This is stanza name which is defined in props.conf in point 1.

REGEX= .

DEST_KEY=_SYSLOG_ROUTING

FORMAT=SymantecMSS

# This group name has to be same as defined in outputs.conf file
0 Karma

woodcock
Esteemed Legend

You have not discriminated for your domain controllers in the REGEX inside transforms.conf. The period character says, "if the event has at least 1 character", then send it. You need to build a RegEx that says "if the event contains a hostname like this or an IP address like that", then send it.

cburgman
Path Finder

Is it possible to send data by Sourcetype instead of specifying a hostname/ip in the regex?

0 Karma

woodcock
Esteemed Legend

Yes, of course, you have been doing just exactly that! But for this to benefit you, you would have to have the Domain Controllers sending to one sourcetype and everything else to another.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...