Selectively forwarding syslog to a syslog server

[JovanMilosevic]

Hi,

I have a number of syslog feeds coming into my indexer on udp port 514.

I want to forward the syslog from one of the hosts on to another syslog server.

I have set up entries in inputs.conf, props.conf, and transforms.conf, and can successfully forward all syslog data to the syslog server, but cannot do as the manual suggests, and forward from one host.

If I use [syslog] as the stanza name in props.conf, all syslog gets forwarded as one would expect.

If I use [source::upd:514] as the stanza in props.conf, the same - all syslog gets forwarded.

If however, I do as the manual suggests, and use [host::hostname] - nothing gets forwarded. I have also tried using the IP Address instead of the hostname, still nothing.

Am I missing something obvious here ?

Thanks.

[yannK]

If you want to forward a subset of your events as syslog, read this document :
http://docs.splunk.com/Documentation/Splunk/5.0.1/Deploy/Routeandfilterdatad#Replicate_a_subset_of_d...

[bmacias84]

Why manual are you referring to?

[Damien_Dallimor]

Have a look at the specs for outputs.conf

At the end of that page , you will find a section detailing how to configure props.conf, transforms.conf and outputs.conf to route events to another syslog server

[AppServices]

I believe hostname is referring to the value of host that is set in conjunction with a monitored file.

Being that you are receiving these files via udp, your inputs.conf might look something like this:

[udp://514]
connection_host = syslog.company.com
sourcetype = ltm_log
source = ltm

In this example, you would set hostname to syslog.company.com in props.conf.