Getting Data In

Is there a parmeter for _TCP_ROUTING when using splunk oneshot?

aa70627
Communicator

I currently have a UF that is sending data to two different Splunk environment. 

[monitor:///data/folder1/]
index=main
sourcetype=applog1
_TCP_ROUTING = SplunkTEST
crcSalt = <SOURCE> 

[monitor:///data/folder2/]
index=main
sourcetype=applog2
_TCP_ROUTING = SplunkPROD
crcSalt = <SOURCE> 

 

When i run the following oneshot command it sends it to my SplunkPROD. How do i ensure it sends to SplunkTEST? Is there a setting for _TCP_ROUTING

/opt/splunkforwarder/bin/splunk add oneshot /data/data/folder1/app1.log -index main -sourcetype "applog1"

 

Labels (2)
0 Karma

VatsalJagani
SplunkTrust
SplunkTrust

Splunk does not create inputs.conf stanza when using one shot.

-------

If this is something you need regularly and you are okay to move from UF to Heavy Forwarder, then you can use TCP Routing from props.conf and transforms.conf.

(This will not work on Universal Forwarder)

 

props.conf
[applog1]
TRANSFORMS-routing=my_transforms_routing

transforms.conf
[my_transforms_routing]
REGEX=.*
DEST_KEY=_TCP_ROUTING
FORMAT=SplunkTEST

 

 

Please read the reference - https://docs.splunk.com/Documentation/Splunk/8.2.5/Forwarding/Routeandfilterdatad

Note - This will apply on all the data under applog1 sourcetype.

 

Hope this helps!  If it resolves your issue, consider accepting and upvoting!!

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The oneshot command does not have a _TCP_ROUTING option.

I'm not sure the oneshot command honors inputs.conf settings since it's not a configured input.

---
If this reply helps you, Karma would be appreciated.
0 Karma

aa70627
Communicator

how does it determine where to send the oneshot to in this scenario? I've checked both environment and it only sends the SplunkPROD and not both. 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The destination will be specified in the outputs.conf file.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...

Want to Reduce Costs, Mitigate Risk, Improve Performance, or Increase Efficiencies? ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...