Getting Data In

Route Data based on Heavy Forwarder Host?

ajiwanand
Path Finder

We're approaching this from an MSSP standpoint.
We're looking at having an intermediate forwarder layer where we route data in a shared layer based on the client heavy forwarders.
Essentially it would go Client HF -> Intermediate Forwarder Layers Route based on host -> Client Indexer

Is this possible? I cant seem to get the props/transforms config to work

props.conf
[default]
TRANSFORMS-setrouting = tsthost-routing
TRANSFORMS-setrouting = abchost-routing

transforms.conf
[tsthost-routing]
SOURCE_KEY = MetaData:Host
REGEX = (hf1_tst)
DEST_KEY = _TCP_ROUTING
FORMAT = client-tst-lb-indexers

[abchost-routing]
SOURCE_KEY = MetaData:Host
REGEX = (hf1_abc)
DEST_KEY = _TCP_ROUTING
FORMAT = client-abc-lb-indexers

Im aware of potential parsing issues as well and well be evaluating that.

Thanks

Labels (3)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

if the client has dedicated indexers, why not have the client HF send directly to them using outputs.conf?

---
If this reply helps you, Karma would be appreciated.
0 Karma

ajiwanand
Path Finder

Lots of reasons, mainly the deployment is hosted on AWS and getting push back from security for having an internet gateway, so we're trying to propose a separate VPC with an intermediate forwarding layer connected to the deployment VPCs over a private link.

0 Karma

493669
Super Champion

@ajiwanand Can you try including both transforms stanza in one-
props.conf

[default]
TRANSFORMS-setrouting = tsthost-routing, abchost-routing
0 Karma

ajiwanand
Path Finder

Nope, no luck. It still sends to both deployments. I asked on the slack group and they mentioned HF to Intermediate HF routing does not work unless you do some "hacks" and that it works for UF but not HF unsure if this is true as ive read documentation that seem to state its possible..

0 Karma
Get Updates on the Splunk Community!

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...