Getting Data In

How to index Windows event logs data and forward it to an external syslog server?

Path Finder

I want to send Windows event log data from several domain controllers to Splunk to be indexed as well as an external syslog collector. I am currently receiving the logs in Splunk with no issues. The problem arises when I attempt to forward the WinEvent data to my syslog server. Once I enable the syslog service, I get flooded with all of my data being forwarded to the external collector. I only want the data from the domain controllers.

Nutshell:
-Windows data is being sent via a universal forwarder with no issues.
-The data (only Windows data) needs to be indexed and forwarded over to an external syslog collector.
-Created new outputs.conf, props.conf and transforms.conf to output data to external collector.
-When the syslog service is enabled it is flooded with ALL of the data being sent to Splunk.
-Syslog Server IP: xx.xx.xxx.xx
-Port: TCP 514
-Splunk Version 6.3.3

outputs.conf:

[syslog]
defaultGroup = SymantecMSS

[syslog:SymantecMSS]
server = xx.xx.xxx.xx:514
type = tcp
priority = <13>
timestampformat = %b %d %H:%M:%S
maxEventSize = 16384

props.conf:

[source::WinEventLog:*]
TRANSFORMS-WinEventLog=SymantecMSSStanza

transforms.conf:

[SymantecMSSStanza]

# This is stanza name which is defined in props.conf in point 1.

REGEX= .

DEST_KEY=_SYSLOG_ROUTING

FORMAT=SymantecMSS

# This group name has to be same as defined in outputs.conf file
0 Karma

Esteemed Legend

You have not discriminated for your domain controllers in the REGEX inside transforms.conf. The period character says, "if the event has at least 1 character", then send it. You need to build a RegEx that says "if the event contains a hostname like this or an IP address like that", then send it.

Path Finder

Is it possible to send data by Sourcetype instead of specifying a hostname/ip in the regex?

0 Karma

Esteemed Legend

Yes, of course, you have been doing just exactly that! But for this to benefit you, you would have to have the Domain Controllers sending to one sourcetype and everything else to another.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!