Getting Data In

Replicate a subset of data to a third-party system for specific index

evinasco
Communicator

Hi team

i need to foward a copy data from specific index to third-party system, someone knows how i can do that

regards

Tags (1)
0 Karma

MuS
Legend

Hi evinasco,

Have a look at the docs here https://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Routeandfilterdatad#Replicate_a_subse...

Please note, that this setting is only configurable based on host, source or sourcetype but NOT on index.

Hope this helps ...

cheers, MuS

0 Karma

evinasco
Communicator

Hi @MuS, Do you know if this configuration shall do in the transforms.conf?

[routeAll]
REGEX=(.)
DEST_KEY=_TCP_ROUTING
FORMAT=Everything

[routeSubset]
REGEX=(sourcetype1|sourcetype2|sourcetype3)
DEST_KEY=_TCP_ROUTING
FORMAT=Subsidiary,Everything

regadrs

0 Karma

MuS
Legend

Actually something like this would make more sense:

props.conf

[sourcetype1]
TRANSFORMS-001-Send-Subsidiary-sourcetype1 = Send-Subsidiary-sourcetype

[sourcetype2]
TRANSFORMS-002-Send-Subsidiary-sourcetype2 = Send-Subsidiary-sourcetype

[sourcetype1]
TRANSFORMS-003-Send-Subsidiary-sourcetype3 = Send-Subsidiary-sourcetype

transforms.conf

[Send-Subsidiary-sourcetype]
DEST_KEY = _TCP_ROUTING
FORMAT = Subsidiary, Everything

The reason for that is if you send everything by default to one destination, there is no need to configure a transforms stanza for this and add additional parsing load for these events 😉

Hope that makes sense ...

cheers, MuS

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...