Getting Data In

Is it possible to route data on the cloud HF like this?

danielbb
Motivator

As we work on the migration to the cloud, we have the following case -

We are sending the syslog data to a heavy forwarder on the cloud (and to the on-prem indexers), to its 9997 port. When reaching this HF, we would like to fork just the firewall data to a subset of the indexers. Is it possible to make such a routing?

We would like to have something like - 

 

[<transforms_stanza_name>]
SOURCE=index
REGEX=^firewall
DEST_KEY=_TCP_ROUTING
FORMAT=<subset of cloud indexers>

 

 

Labels (1)
0 Karma

danielbb
Motivator

Hi @gcusello

The data that I'm referring to, is cooked data that we ingest into the HF via the 9997 port.  Can this data be routed from the HF to specific cloud indexers? 

Sorry if I wasn't clear earlier. 

 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @danielbb,

it's a best practice to use at least two HFs as concentrators to send logs to Splunk Cloud.

Obviously, transformations must be implemented on these HFs.

Ciao.

Giuseppe

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @danielbb,

yes it's correct.

Obviously, you have to do all the steps described at https://docs.splunk.com/Documentation/Splunk/9.0.0/Forwarding/Routeandfilterdatad#Filter_and_route_e...

In other words, you have also to insert the two destinations in outputs.conf and insert in the props.conf the relative stanza.

Ciao.

Giuseppe

danielbb
Motivator

Hi @gcusello 

Great explanation on this page - 

Heavy forwarders can filter and route data to specific receivers based on source, source type, or patterns in the events themselves. For example, you can send all data from one group of machines to one indexer and all data from a second group of machines to a second indexer. Heavy forwarders can also look inside the events and filter or route accordingly. For example, you could use a heavy forwarder to inspect WMI event codes to filter or route Windows events. This topic describes a number of typical routing scenarios.


0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @danielbb,

if one answer solves your need, please accept one answer for the other people of Community or tell me how I can help you.

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...