Getting Data In

In a heavy forwarder, how do I select specific windows event ids and reparse them as single line events?

pete222
New Member

I have windows event logs coming into a heavy forwarder, which I don’t need to index. All I need to do is select a couple of windows event ids, reparse them and send them to a 3rd party as single line events. I’ve read a lot of articles about forwarding and similar types of posts, but I cannot seem to get this to work. Any help would be greatly appreciated!
This is what I have so far:

inputs.conf 
[tcp://9997]
sourcetype = for3rdparty
queueSize = 50KB
persistentQueueSize=200MB
queue = parsingQueue

outputs.conf
[tcpout:3rdparty]
server = 1.1.1.1:1111
sendCookedData = false

props.conf
[for3rdparty]
SEDCMD-rmlines = s/[\n\t\r]/ /g
TRANSFORMS-1capture = capture_for_3rdparty
TRANSFORMS-2reparse = reparse_for_3rdparty
TRANSFORMS-3route = route_to_3rdparty

transforms.conf
[capture_for_3rdparty]
REGEX=(?ms)^EventCode=(111|222|333)(.*)
DEST_KEY=_raw

[reparse_for_3rdparty]
REGEX = <regex>
FORMAT = $1::$2
DEST_KEY = _raw

[route_to_3rdparty]
REGEX =.
DEST_KEY=_TCP_ROUTING
FORMAT= for3rdparty
0 Karma
1 Solution

sudosplunk
Motivator

Is there any reason not using _TCP_ROUTING in inputs.conf? I meant, does below implementation works?

inputs.conf:

[tcp://9997]
sourcetype = for3rdparty
whitelist = 111, 222, 333
_TCP_ROUTING = for3rdparty
persistentQueueSize=200MB

Props.conf:

[for3rdparty]
SEDCMD-rmlines = s/[\n\t\r]/ /g

Outputs.conf:

[tcpout:for3rdparty]
server = 1.1.1.1:1111
sendCookedData = false

View solution in original post

0 Karma

sudosplunk
Motivator

Is there any reason not using _TCP_ROUTING in inputs.conf? I meant, does below implementation works?

inputs.conf:

[tcp://9997]
sourcetype = for3rdparty
whitelist = 111, 222, 333
_TCP_ROUTING = for3rdparty
persistentQueueSize=200MB

Props.conf:

[for3rdparty]
SEDCMD-rmlines = s/[\n\t\r]/ /g

Outputs.conf:

[tcpout:for3rdparty]
server = 1.1.1.1:1111
sendCookedData = false
0 Karma

pete222
New Member

Hi
Apologies for the slow response. I did as you suggested, used _TCP_ROUTING in inputs.conf and everything works as it should. Thanks!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...