Getting Data In

How to route in two directions with restrictions on one?

BDein
Explorer

Hi,

Here is a challenge that works partly as expected.
On a HF I need to split syslog data to two different instances, one internal in the company, and secondly to an external company (that does investigations on these).
The external company has provided a sysmon config file, which collect all they need, but which on the other hand provides too much internally.

The split of data sending two ways works great using props, transforms and outputs.

Now the challenge is to remove some of the events send to the internal tcp group.
props.conf

 

[source::XmlWinEventLog:Microsoft-Windows-Sysmon/Operational]
TRANSFORMS-routing = sysmon-routeToExt, sysmon-routeToInt

 

transforms.conf

 

[sysmon-routeToInt]
SOURCE_KEY = MetaData:Host
REGEX = (?i)(.*)
DEST_KEY=_TCP_ROUTING
FORMAT=TcpOut_Int

[sysmon-routeToExt]
SOURCE_KEY = MetaData:Host
REGEX = (?i)(.*)
DEST_KEY=_TCP_ROUTING
FORMAT=TcpOut_Ext

 

One of the basic questions is: Is there a way to use props (order vise) so it will be possible to send everything to one tcp group (external), and with the same events then filter (drop some events using REGEX), and send the remaining events to the second tcp group (internal) ?

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

have you look CLONE_SOURCETYPE https://docs.splunk.com/Documentation/Splunk/latest/Admin/Transformsconf ?
That could help you?

r. Ismo

0 Karma
Get Updates on the Splunk Community!

OpenTelemetry for Legacy Apps? Yes, You Can!

This article is a follow-up to my previous article posted on the OpenTelemetry Blog, "Your Critical Legacy App ...

UCC Framework: Discover Developer Toolkit for Building Technology Add-ons

The Next-Gen Toolkit for Splunk Technology Add-on Development The Universal Configuration Console (UCC) ...

.conf25 Community Recap

Hello Splunkers, And just like that, .conf25 is in the books! What an incredible few days — full of learning, ...