Is it possible to deploy a universal forwarder that monitors the same log source twice and routes the data differently?

[joshuasolman]

Hello would it be possible to deploy a universal forwarder that monitors the same log source twice and routes the data differently based on what i want to collect? 

For example, two different apps on the UF 

App1: 

Inputs.conf - All winevent logs (including security)

Outputs.conf - Going to indexer

App2: 

Inputs.conf - WinEventSecurity logs (whitelisted for two events) 

Outputs.conf - Seperate destination

Would there be any issues reading the security log twice or would there be confliction?

[PickleRick]

No, you can't. As @gcusello already pointed out, UF is a relatively simple tool thst doesn't allow for many advanced index-time operations that indexers and HFs allow. Furthermore, you cannot (short of doing some dirty tricks with symlinking in case of file monitoring inputs) define the same stanza twice. So you can't have two separate winevent://security sources. You'd just overwrite some settings from the first definition with the second one.

You could (although it's not supported and not heavily tested I suppose) try to install and run two separate instances of UF on one host. But it kinda defeats the purpose - if you're gonna use it to send your events to another solution, why not use that solution's dedicated monotoring tool?

[gcusello]

Hi @joshuasolman,

did you already tested the steps  described at https://docs.splunk.com/Documentation/Splunk/8.2.5/Forwarding/Routeandfilterdatad#Replicate_a_subset... ?

In this page is descripted the configuration to send all data to indexers and a part of them (identified by a regex) to a third party system.

Ciao.

Giuseppe

[joshuasolman]

I did see this, but i see it only mentions Heavy Forwarders. Is it possible to do this on Universal Forwarders? 

[SinghK]

I think you will need to create a routing rule and add both destinations in outputs.conf

[gcusello]

Hi @joshuasolman,

no, only on HFs or Indexers, because the Parsing Phase isn't present on UFs.

Maybe you could send all data both to Splunk and Third Party system and then filter on those systems, in this case you can configure UFs to send to both the destinations.

Ciao.

Giuseppe