Getting Data In

Route Data based on Heavy Forwarder Host?

ajiwanand
Path Finder

We're approaching this from an MSSP standpoint.
We're looking at having an intermediate forwarder layer where we route data in a shared layer based on the client heavy forwarders.
Essentially it would go Client HF -> Intermediate Forwarder Layers Route based on host -> Client Indexer

Is this possible? I cant seem to get the props/transforms config to work

props.conf
[default]
TRANSFORMS-setrouting = tsthost-routing
TRANSFORMS-setrouting = abchost-routing

transforms.conf
[tsthost-routing]
SOURCE_KEY = MetaData:Host
REGEX = (hf1_tst)
DEST_KEY = _TCP_ROUTING
FORMAT = client-tst-lb-indexers

[abchost-routing]
SOURCE_KEY = MetaData:Host
REGEX = (hf1_abc)
DEST_KEY = _TCP_ROUTING
FORMAT = client-abc-lb-indexers

Im aware of potential parsing issues as well and well be evaluating that.

Thanks

Labels (3)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

if the client has dedicated indexers, why not have the client HF send directly to them using outputs.conf?

---
If this reply helps you, Karma would be appreciated.
0 Karma

ajiwanand
Path Finder

Lots of reasons, mainly the deployment is hosted on AWS and getting push back from security for having an internet gateway, so we're trying to propose a separate VPC with an intermediate forwarding layer connected to the deployment VPCs over a private link.

0 Karma

493669
Super Champion

@ajiwanand Can you try including both transforms stanza in one-
props.conf

[default]
TRANSFORMS-setrouting = tsthost-routing, abchost-routing
0 Karma

ajiwanand
Path Finder

Nope, no luck. It still sends to both deployments. I asked on the slack group and they mentioned HF to Intermediate HF routing does not work unless you do some "hacks" and that it works for UF but not HF unsure if this is true as ive read documentation that seem to state its possible..

0 Karma
Get Updates on the Splunk Community!

Introducing Splunk Enterprise 9.2

WATCH HERE! Watch this Tech Talk to learn about the latest features and enhancements shipped in the new Splunk ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...