Need help with TCP routing of events from Universal Forwarder

[joshuapetitt]

Hi all,

I'm using Splunk Enterprise 9.4.x with Windows Universal Forwarders.

I'm trying to route specific sources and sourcetypes to a special Splunk Indexer, while all other events are routed to the default Indexer.

I have the following outputs.conf on the UF

[tcpout]

defaultGroup = splunkssl # this is defined in another outputs.conf and this works

[tcpout:special]

server = 1.2.3.4:9998

[tcpout-server://1.2.3.4:9998]

sslRootCAPath = # custom cert

sslVerifyServerCert = true

sslCommonNameToCheck = # custom common name

altCommonNameToCheck = 1.2.3.4

I have the following props.conf on the UF

[source::WinEventLog:Microsoft-Windows-PowerShell/Operational]

TRANSFORMS-route = route_to_special

I have the following transforms.conf on the UF

[route_to_special]

REGEX = .

DEST_KEY = _TCP_ROUTING

FORMAT = special

What I am seeing is that the _internal logs are being sent to the special Indexer, but no other events.

The WinEventLog:Microsoft-Windows-PowerShell/Operational are still being sent to the default Indexer.

What am I doing wrong?

Should I expect this to work? 
Should this work for WinEventLog inputs?

[joshuapetitt]

This works! Thanks for your quick response 🙂

[livehybrid · Accepted solution]

Hi @joshuapetitt 

A UF doesnt typically perform transformations such as those you are trying to do because it isnt done during the phases of ingest that the UF performs. 

Instead you could set the _TCP_ROUTING value for your input such as:

[WinEventLog://Microsoft-Windows-PowerShell/Operational]
... the rest of your config...
_TCP_ROUTING = special

For more info on this setting see https://help.splunk.com/en/data-management/splunk-enterprise-admin-manual/9.1/configuration-file-ref...

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing