Getting Data In

Route Data based on Heavy Forwarder Host?

ajiwanand
Path Finder

We're approaching this from an MSSP standpoint.
We're looking at having an intermediate forwarder layer where we route data in a shared layer based on the client heavy forwarders.
Essentially it would go Client HF -> Intermediate Forwarder Layers Route based on host -> Client Indexer

Is this possible? I cant seem to get the props/transforms config to work

props.conf
[default]
TRANSFORMS-setrouting = tsthost-routing
TRANSFORMS-setrouting = abchost-routing

transforms.conf
[tsthost-routing]
SOURCE_KEY = MetaData:Host
REGEX = (hf1_tst)
DEST_KEY = _TCP_ROUTING
FORMAT = client-tst-lb-indexers

[abchost-routing]
SOURCE_KEY = MetaData:Host
REGEX = (hf1_abc)
DEST_KEY = _TCP_ROUTING
FORMAT = client-abc-lb-indexers

Im aware of potential parsing issues as well and well be evaluating that.

Thanks

Labels (3)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

if the client has dedicated indexers, why not have the client HF send directly to them using outputs.conf?

---
If this reply helps you, Karma would be appreciated.
0 Karma

ajiwanand
Path Finder

Lots of reasons, mainly the deployment is hosted on AWS and getting push back from security for having an internet gateway, so we're trying to propose a separate VPC with an intermediate forwarding layer connected to the deployment VPCs over a private link.

0 Karma

493669
Super Champion

@ajiwanand Can you try including both transforms stanza in one-
props.conf

[default]
TRANSFORMS-setrouting = tsthost-routing, abchost-routing
0 Karma

ajiwanand
Path Finder

Nope, no luck. It still sends to both deployments. I asked on the slack group and they mentioned HF to Intermediate HF routing does not work unless you do some "hacks" and that it works for UF but not HF unsure if this is true as ive read documentation that seem to state its possible..

0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...