Getting Data In

_TCP_ROUTING for windows monitored data is not routed appropriately in Splunk Version 6

rbal_splunk
Splunk Employee
Splunk Employee

After upgrading SplunkUniversalForwader from Version 5.x to 6.x, now _TCP_ROUTING for windows monitored data is not routed appropriately.
For example:

1)Inputs.conf are

[WinEventLog://Application]

_TCP_ROUTING = unix

[WinEventLog://Security]

[WinEventLog://System]

_TCP_ROUTING = unix

[monitor://C:/Important/unix.log]

_TCP_ROUTING = unix


ii)Outputs.conf

[tcpout]
defaultGroup = win

[tcpout:win]
server = testserver1:9997

[tcpout:unix]
server = testserver2:24003


Data for following sources should have routed to group ‘unix’, but got routed to tcpout:win

[WinEventLog://Application]
[WinEventLog://System]

Only [monitor://C:/Important/unix.log] got routed to _TCP_ROUTING = unix, other windows event data is routed to defaultGroup = win

Tags (2)

rbal_splunk
Splunk Employee
Splunk Employee

The behavior explained above has been identified as Bug (SPL-79009) and is expected to fixed in 6.0.3.
In 6.0, WinEventLog is changed to modular input, while in 5.0 it's a splunkd input processor. Issue is _TCP_ROUTING is not supported by modular input. Therefore, to work around this issue.
The proposed workaround is to set default receiver as the one for modular input, i.e., set the outputs.conf as:
[tcpout]
defaultGroup = unix

[tcpout:win]
server = 192.168.0.107:9997

[tcpout:unix]
server = 10.160.31.12:24003
and set inputs.conf as:
[default]
_TCP_ROUTING = win

[WinEventLog://Application]
checkpointInterval = 5
current_only = 0

[WinEventLog://Security]
checkpointInterval = 5
current_only = 0

[WinEventLog://System]
disabled = 0

[monitor://C:\Important\unix.log]
_TCP_ROUTING = unix
host = RBAL_UF
index = default
sourcetype = unix

Get Updates on the Splunk Community!

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...