Getting Data In

Splunk HF send only auditd, syslog, linux_secure to 3rd party syslog

Explorer

I am having trouble wrapping my head around how to configure a HF to forward the sourcetypes of syslog and auditd to a 3rd party syslog host as well as to an indexer, without sending other sourcetypes as well.

I am trying to use a combination of these to docs to help but I have not been successful yet.
Route and filter data
Forward data to third-party systems

My configs look like this right now.

props.conf

[syslog]
TRANSFORMS-routing = routeAll, send_to_syslog

[auditd]
TRANSFORMS-routing = routeAll, send_to_syslog

[cpu]
TRANSFORMS-routing = routeAll

[ps]
TRANSFORMS-routing = routeAll

transforms.conf

[routeAll]
REGEX = (.)
DEST_KEY = _TCP_ROUTING
FORMAT = default-autolb-group

[send_to_syslog]
REGEX = (.)
DEST_KEY = _SYSLOG_ROUTING
FORMAT = syslogGroup

outputs.conf

[tcpout]
defaultGroup = default-autolb-group

[tcpout:default-autolb-group]
server = Y.Y.Y.Y:9997

[tcpout-server://Y.Y.Y.Y:9997]

[indexAndForward]
index = false

[syslog]
defaultGroup=syslogGroup

[syslog:syslogGroup]
server = X.X.X.X:514
sendCookedData = false
type = tcp
0 Karma

Path Finder

Hi ZimmermanC1 ,

PFB link for forwarding syslog log data to indexer or third part syslog host by HF.

https://splunkonbigdata.com/2019/07/09/syslog-integration-with-splunk/

Let me know.

0 Karma

Explorer

My issue is that i need a configuration that will only forward events to my 3rd party syslog server that come from monitoring of:
/var/log/messages
/var/log/secure
/var/log/audit/audit.log
Even if I have other scripts running via the Splunk_TA_nix app on each UF that is feeding the HF.

Right now I can only get the HF to send all events to both the Splunk Indexers and the 3rd party syslog server.
As an example, I have ps.sh enabled to run every 10 minutes via Splunk_TA_nix on each machine that has a UF installed on it. I want the PS events to go to the indexers but not into the 3rd party syslog server.

0 Karma

Explorer

No, there is only 1 HF collecting from dozens of UF. The HF is being used as a network segmentation conduit.

0 Karma

SplunkTrust
SplunkTrust

Hi @ZimmermanC1,
what's the wrong behaviour you have?
Have you also other Heavy Forwarders that sends these logs to this HF?

Ciao.
Giuseppe

0 Karma

SplunkTrust
SplunkTrust

Hi @ZimmermanC1,
OK what's the wrong behaviour you have?

Ciao.
Giuseppe

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!