Routing and filtering syslog

ezparra05 · ‎02-05-2021

Have Palo Alto logs being sent to syslog-ng server. A UF is on the syslog-ng and forwarding logs to Heavy Forwarder. I have a list of specific firewall (hostnames) and zones that I need to filter a copy of the traffic by and send to different (separate) indexer . Is it possible to filter and route using either the UF or HF?

scelikok · ‎02-05-2021

Hi @ezparra05,

You should use HF for route/filter data. Please see below document.

https://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Routeandfilterdatad

If this reply helps you an upvote and "Accept as Solution" is appreciated.

Routing and filtering syslog

heavy forwarder

universal forwarder

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Introducing ITSI 5.0: Unified Visibility and Actionable Insights

Inside Splunk Agent Observability: Understanding Agent Behavior, Tokens & Costs

From Data to Insight: Announcing the Winners of the Splunk Dashboard Contest

Join the Conversation

Routing and filtering syslog

heavy forwarder

universal forwarder

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Introducing ITSI 5.0: Unified Visibility and Actionable Insights

Inside Splunk Agent Observability: Understanding Agent Behavior, Tokens & Costs

From Data to Insight: Announcing the Winners of the Splunk Dashboard Contest