I am having trouble wrapping my head around how to configure a HF to forward the sourcetypes of syslog and auditd to a 3rd party syslog host as well as to an indexer, without sending other sourcetypes as well.
I am trying to use a combination of these to docs to help but I have not been successful yet.
Route and filter data
Forward data to third-party systems
My configs look like this right now.
[syslog] TRANSFORMS-routing = routeAll, send_to_syslog [auditd] TRANSFORMS-routing = routeAll, send_to_syslog [cpu] TRANSFORMS-routing = routeAll [ps] TRANSFORMS-routing = routeAll
[routeAll] REGEX = (.) DEST_KEY = _TCP_ROUTING FORMAT = default-autolb-group [send_to_syslog] REGEX = (.) DEST_KEY = _SYSLOG_ROUTING FORMAT = syslogGroup
[tcpout] defaultGroup = default-autolb-group [tcpout:default-autolb-group] server = Y.Y.Y.Y:9997 [tcpout-server://Y.Y.Y.Y:9997] [indexAndForward] index = false [syslog] defaultGroup=syslogGroup [syslog:syslogGroup] server = X.X.X.X:514 sendCookedData = false type = tcp
My issue is that i need a configuration that will only forward events to my 3rd party syslog server that come from monitoring of:
Even if I have other scripts running via the Splunk_TA_nix app on each UF that is feeding the HF.
Right now I can only get the HF to send all events to both the Splunk Indexers and the 3rd party syslog server.
As an example, I have ps.sh enabled to run every 10 minutes via Splunk_TA_nix on each machine that has a UF installed on it. I want the PS events to go to the indexers but not into the 3rd party syslog server.