Getting Data In

How to send syslog data to the indexer and another TCP listener? (Part 4)

Log_wrangler
Builder

This question is based off earlier questions, but I am looking for someone to confirm that the following conf is written correctly.
Reference link is
http://docs.splunk.com/Documentation/SplunkCloud/6.6.3/Forwarding/Routeandfilterdatad#Replicate_a_su...

Scenario:

I have a data source that I want to send to a Splunk Fwdr which will then fork ALL the cooked data to 1) my indexers (autoLB) AND 2) ALL the uncooked data to a thrid party TCP listener.

Here is what I have

Edit $SPLUNK_HOME/etc/system/local/props.conf

[syslog]
TRANSFORMS-routing = routeAll, routeSubset


Edit $SPLUNK_HOME/etc/system/local/transforms.conf

[routeAll]
REGEX=(.)    <-------- This specifies all data goes to the indexer
DEST_KEY=_TCP_ROUTING
FORMAT=Everything   <-------- This specifies all data goes to the indexer


[routeSubset]
REGEX=(.)   <--------- This is specifies all data would go to the 3rd party tcp listener
DEST_KEY=_TCP_ROUTING
FORMAT=Subsidiary   < ----------------- This specifies that all data would go to the 3rd party TCP receiver as "subsidiary"


Edit $SPLUNK_HOME/etc/system/local/outputs.conf

[tcpout]
defaultGroup=nothing

[tcpout:Everything]
disabled=false
server=x.x.x.x:9997   <---- my splunk indexer

[tcpout:Subsidiary]
disabled=false
sendCookedData=false
server=x.x.x.x:1234   <---- the 3rd party app tcp receiver

however is there a simpler way to write this? I just don't know of a way to say "uncooked to 3rd party" and "cooked to indexers" in one stanza?

Thank you

Tags (2)
0 Karma
1 Solution

somesoni2
Revered Legend

The TRANSFORM routeSubset will be executed first and will send all data to 3rd party TCP receiver. Thus no events will go to your indexer. Since you want to clone the data for syslog, try something like this

Edit $SPLUNK_HOME/etc/system/local/props.conf

 [syslog]
 TRANSFORMS-routing = cloneAll

Edit $SPLUNK_HOME/etc/system/local/transforms.conf

[cloneAll]
 REGEX=(.)   
 DEST_KEY=_TCP_ROUTING
 FORMAT=Everything,Subsidiary      <-------- This specifies all data goes to both indexer and Subsidiary  

No change to outputs.conf

View solution in original post

somesoni2
Revered Legend

The TRANSFORM routeSubset will be executed first and will send all data to 3rd party TCP receiver. Thus no events will go to your indexer. Since you want to clone the data for syslog, try something like this

Edit $SPLUNK_HOME/etc/system/local/props.conf

 [syslog]
 TRANSFORMS-routing = cloneAll

Edit $SPLUNK_HOME/etc/system/local/transforms.conf

[cloneAll]
 REGEX=(.)   
 DEST_KEY=_TCP_ROUTING
 FORMAT=Everything,Subsidiary      <-------- This specifies all data goes to both indexer and Subsidiary  

No change to outputs.conf

Log_wrangler
Builder

Thank you I will test it and let you know.

0 Karma

Log_wrangler
Builder

so this is what I am going to test, fyi, hopefully I wrote it correctly

Edit $SPLUNK_HOME/etc/system/local/props.conf

[syslog]
TRANSFORMS-routing = cloneAll


Edit $SPLUNK_HOME/etc/system/local/transforms.conf

[cloneAll]
REGEX=(.)
DEST_KEY=_TCP_ROUTING
FORMAT=Everything,Subsidiary  


Edit $SPLUNK_HOME/etc/system/local/outputs.conf

[tcpout]
defaultGroup=nothing

[tcpout:Everything]
disabled=false
server=x.x.x.x:9997   <---- my splunk indexer

[tcpout:Subsidiary]
disabled=false
sendCookedData=false
server=x.x.x.x:1234   <---- the 3rd party app tcp receiver
0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...