Getting Data In

How to route in two directions with restrictions on one?

BDein
Explorer

Hi,

Here is a challenge that works partly as expected.
On a HF I need to split syslog data to two different instances, one internal in the company, and secondly to an external company (that does investigations on these).
The external company has provided a sysmon config file, which collect all they need, but which on the other hand provides too much internally.

The split of data sending two ways works great using props, transforms and outputs.

Now the challenge is to remove some of the events send to the internal tcp group.
props.conf

 

[source::XmlWinEventLog:Microsoft-Windows-Sysmon/Operational]
TRANSFORMS-routing = sysmon-routeToExt, sysmon-routeToInt

 

transforms.conf

 

[sysmon-routeToInt]
SOURCE_KEY = MetaData:Host
REGEX = (?i)(.*)
DEST_KEY=_TCP_ROUTING
FORMAT=TcpOut_Int

[sysmon-routeToExt]
SOURCE_KEY = MetaData:Host
REGEX = (?i)(.*)
DEST_KEY=_TCP_ROUTING
FORMAT=TcpOut_Ext

 

One of the basic questions is: Is there a way to use props (order vise) so it will be possible to send everything to one tcp group (external), and with the same events then filter (drop some events using REGEX), and send the remaining events to the second tcp group (internal) ?

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

have you look CLONE_SOURCETYPE https://docs.splunk.com/Documentation/Splunk/latest/Admin/Transformsconf ?
That could help you?

r. Ismo

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

What Is Splunk? Here’s What You Can Do with Splunk

Hey Splunk Community, we know you know Splunk. You likely leverage its unparalleled ability to ingest, index, ...

Level Up Your .conf25: Splunk Arcade Comes to Boston

With .conf25 right around the corner in Boston, there’s a lot to look forward to — inspiring keynotes, ...

Manual Instrumentation with Splunk Observability Cloud: How to Instrument Frontend ...

Although it might seem daunting, as we’ve seen in this series, manual instrumentation can be straightforward ...