Is it possible to index and forward a specific sourcetype from an indexer?

[brendan_wilson]

I have a situation in which I need to get events from our Windows servers to a third-party device for a managed security provider. We have been doing this on the universal forwarder layer with mixed success. At the moment, the events get to the third party device and our two indexers, but field extractions are totally broken for the Windows security events. The universal forwarders also use props and transforms on the data going out to the third party device to ensure it is formatted correctly for our managed security provider (which is where I suspect the field extractions are going wrong).

What I would like to do is forward these events from the indexers instead to make managing this situation a bit easier (forwarding to the third party device from a single point, rather than a hundred disparate points across our network). Essentially what I want is this:

1) Universal forwarder forwards all Windows logs to our indexers as normal
2) The indexers index everything, but then forward Windows security event logs (formatted via props and transforms for our security provider) to the third party device

Is this possible?

[somesoni2]

This should help

http://docs.splunk.com/Documentation/Splunk/6.4.3/Forwarding/Routeandfilterdatad#Replicate_a_subset_...

[brendan_wilson]

I looked through that. While it seems to be talking about my use case, the page itself only references this stuff happening at the universal forwarder layer. What I'm asking is if this data can be forwarded from an indexer?

[somesoni2]

I've not tried this myself but I believe if you do the mentioned configuration on Indexer (setting outputs.conf with no default group and creating a tcpout group for the third party system) and setup routing for the specific sourcetypes to route to both indexqueue and third party tcpout group, it should work. If you've a test environment when you can play with this, here is what I would try

Indexer outputs.conf

[tcpout]
defaultGroup=nothing

[tcpout:thirdpartsystem]
disabled=false
server=xxx.xxx.xxx.xxx:XXXX

Indexer props.conf

[yourwindowssourcetype1]
TRANSFORMS-routing = routeAll, routeThirdParty

Indexer transforms.conf

[routeAll]
REGEX = . 
DEST_KEY = queue
FORMAT = indexQueue

[routeThirdParty]
REGEX=(.)
DEST_KEY=_TCP_ROUTING
FORMAT=thirdpartsystem

[brendan_wilson]

Thanks for the responses. I'll investigate this further.