Getting Data In

Is it possible to deploy a universal forwarder that monitors the same log source twice and routes the data differently?

joshuasolman
Loves-to-Learn Everything

Hello would it be possible to deploy a universal forwarder that monitors the same log source twice and routes the data differently based on what i want to collect? 

For example, two different apps on the UF 

App1: 

Inputs.conf - All winevent logs (including security)

Outputs.conf - Going to indexer

App2: 

Inputs.conf - WinEventSecurity logs (whitelisted for two events) 

Outputs.conf - Seperate destination

 

Would there be any issues reading the security log twice or would there be confliction?

Labels (3)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

No, you can't. As @gcusello already pointed out, UF is a relatively simple tool thst doesn't allow for many advanced index-time operations that indexers and HFs allow. Furthermore, you cannot (short of doing some dirty tricks with symlinking in case of file monitoring inputs) define the same stanza twice. So you can't have two separate winevent://security sources. You'd just overwrite some settings from the first definition with the second one.

You could (although it's not supported and not heavily tested I suppose) try to install and run two separate instances of UF on one host. But it kinda defeats the purpose - if you're gonna use it to send your events to another solution, why not use that solution's dedicated monotoring tool?

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @joshuasolman,

did you already tested the steps  described at https://docs.splunk.com/Documentation/Splunk/8.2.5/Forwarding/Routeandfilterdatad#Replicate_a_subset... ?

In this page is descripted the configuration to send all data to indexers and a part of them (identified by a regex) to a third party system.

Ciao.

Giuseppe

0 Karma

joshuasolman
Loves-to-Learn Everything

I did see this, but i see it only mentions Heavy Forwarders. Is it possible to do this on Universal Forwarders? 

0 Karma

SinghK
Builder

I think you will need to create a routing rule and add both destinations in outputs.conf

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @joshuasolman,

no, only on HFs or Indexers, because the Parsing Phase isn't present on UFs.

Maybe you could send all data both to Splunk and Third Party system and then filter on those systems, in this case you can configure UFs to send to both the destinations.

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...