How to send syslog data to the indexer and another TCP listener? (Part 4)

[Log_wrangler]

This question is based off earlier questions, but I am looking for someone to confirm that the following conf is written correctly.
Reference link is
http://docs.splunk.com/Documentation/SplunkCloud/6.6.3/Forwarding/Routeandfilterdatad#Replicate_a_su...

Scenario:

I have a data source that I want to send to a Splunk Fwdr which will then fork ALL the cooked data to 1) my indexers (autoLB) AND 2) ALL the uncooked data to a thrid party TCP listener.

Here is what I have

Edit $SPLUNK_HOME/etc/system/local/props.conf

[syslog]
TRANSFORMS-routing = routeAll, routeSubset


Edit $SPLUNK_HOME/etc/system/local/transforms.conf

[routeAll]
REGEX=(.)    <-------- This specifies all data goes to the indexer
DEST_KEY=_TCP_ROUTING
FORMAT=Everything   <-------- This specifies all data goes to the indexer


[routeSubset]
REGEX=(.)   <--------- This is specifies all data would go to the 3rd party tcp listener
DEST_KEY=_TCP_ROUTING
FORMAT=Subsidiary   < ----------------- This specifies that all data would go to the 3rd party TCP receiver as "subsidiary"


Edit $SPLUNK_HOME/etc/system/local/outputs.conf

[tcpout]
defaultGroup=nothing

[tcpout:Everything]
disabled=false
server=x.x.x.x:9997   <---- my splunk indexer

[tcpout:Subsidiary]
disabled=false
sendCookedData=false
server=x.x.x.x:1234   <---- the 3rd party app tcp receiver

however is there a simpler way to write this? I just don't know of a way to say "uncooked to 3rd party" and "cooked to indexers" in one stanza?

Thank you

[somesoni2 · Accepted solution]

The TRANSFORM routeSubset will be executed first and will send all data to 3rd party TCP receiver. Thus no events will go to your indexer. Since you want to clone the data for syslog, try something like this

Edit $SPLUNK_HOME/etc/system/local/props.conf

 [syslog]
 TRANSFORMS-routing = cloneAll

Edit $SPLUNK_HOME/etc/system/local/transforms.conf

[cloneAll]
 REGEX=(.)   
 DEST_KEY=_TCP_ROUTING
 FORMAT=Everything,Subsidiary      <-------- This specifies all data goes to both indexer and Subsidiary  

No change to outputs.conf

[Log_wrangler]

Thank you I will test it and let you know.

[Log_wrangler]

so this is what I am going to test, fyi, hopefully I wrote it correctly

Edit $SPLUNK_HOME/etc/system/local/props.conf

[syslog]
TRANSFORMS-routing = cloneAll


Edit $SPLUNK_HOME/etc/system/local/transforms.conf

[cloneAll]
REGEX=(.)
DEST_KEY=_TCP_ROUTING
FORMAT=Everything,Subsidiary  


Edit $SPLUNK_HOME/etc/system/local/outputs.conf

[tcpout]
defaultGroup=nothing

[tcpout:Everything]
disabled=false
server=x.x.x.x:9997   <---- my splunk indexer

[tcpout:Subsidiary]
disabled=false
sendCookedData=false
server=x.x.x.x:1234   <---- the 3rd party app tcp receiver