Getting Data In

Is it possible to deploy a universal forwarder that monitors the same log source twice and routes the data differently?

joshuasolman
Loves-to-Learn Everything

Hello would it be possible to deploy a universal forwarder that monitors the same log source twice and routes the data differently based on what i want to collect? 

For example, two different apps on the UF 

App1: 

Inputs.conf - All winevent logs (including security)

Outputs.conf - Going to indexer

App2: 

Inputs.conf - WinEventSecurity logs (whitelisted for two events) 

Outputs.conf - Seperate destination

 

Would there be any issues reading the security log twice or would there be confliction?

Labels (3)
0 Karma

PickleRick
Ultra Champion

No, you can't. As @gcusello already pointed out, UF is a relatively simple tool thst doesn't allow for many advanced index-time operations that indexers and HFs allow. Furthermore, you cannot (short of doing some dirty tricks with symlinking in case of file monitoring inputs) define the same stanza twice. So you can't have two separate winevent://security sources. You'd just overwrite some settings from the first definition with the second one.

You could (although it's not supported and not heavily tested I suppose) try to install and run two separate instances of UF on one host. But it kinda defeats the purpose - if you're gonna use it to send your events to another solution, why not use that solution's dedicated monotoring tool?

0 Karma

gcusello
Esteemed Legend

Hi @joshuasolman,

did you already tested the steps  described at https://docs.splunk.com/Documentation/Splunk/8.2.5/Forwarding/Routeandfilterdatad#Replicate_a_subset... ?

In this page is descripted the configuration to send all data to indexers and a part of them (identified by a regex) to a third party system.

Ciao.

Giuseppe

0 Karma

joshuasolman
Loves-to-Learn Everything

I did see this, but i see it only mentions Heavy Forwarders. Is it possible to do this on Universal Forwarders? 

0 Karma

SinghK
Builder

I think you will need to create a routing rule and add both destinations in outputs.conf

0 Karma

gcusello
Esteemed Legend

Hi @joshuasolman,

no, only on HFs or Indexers, because the Parsing Phase isn't present on UFs.

Maybe you could send all data both to Splunk and Third Party system and then filter on those systems, in this case you can configure UFs to send to both the destinations.

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...

Security Highlights | January 2023 Newsletter

January 2023 Splunk Security Essentials (SSE) 3.7.0 ReleaseThe free Splunk Security Essentials (SSE) 3.7.0 app ...

Platform Highlights | January 2023 Newsletter

 January 2023Peace on Earth and Peace of Mind With Business ResilienceAll organizations can start the new year ...