Getting Data In

How to route in two directions with restrictions on one?

BDein
Explorer

Hi,

Here is a challenge that works partly as expected.
On a HF I need to split syslog data to two different instances, one internal in the company, and secondly to an external company (that does investigations on these).
The external company has provided a sysmon config file, which collect all they need, but which on the other hand provides too much internally.

The split of data sending two ways works great using props, transforms and outputs.

Now the challenge is to remove some of the events send to the internal tcp group.
props.conf

 

[source::XmlWinEventLog:Microsoft-Windows-Sysmon/Operational]
TRANSFORMS-routing = sysmon-routeToExt, sysmon-routeToInt

 

transforms.conf

 

[sysmon-routeToInt]
SOURCE_KEY = MetaData:Host
REGEX = (?i)(.*)
DEST_KEY=_TCP_ROUTING
FORMAT=TcpOut_Int

[sysmon-routeToExt]
SOURCE_KEY = MetaData:Host
REGEX = (?i)(.*)
DEST_KEY=_TCP_ROUTING
FORMAT=TcpOut_Ext

 

One of the basic questions is: Is there a way to use props (order vise) so it will be possible to send everything to one tcp group (external), and with the same events then filter (drop some events using REGEX), and send the remaining events to the second tcp group (internal) ?

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

have you look CLONE_SOURCETYPE https://docs.splunk.com/Documentation/Splunk/latest/Admin/Transformsconf ?
That could help you?

r. Ismo

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...