Getting Data In
Highlighted

UDP routing on indexer

Path Finder

Hi All ,

One of our clients wats to use single Splunk instance (indexer) for both receiving and sending data.
They receiving syslog data on port 9997. The next step suppose be routing this data to external system (SIEM).
I've tried to configure routing from indexer to check the issue,but without any success:

props.conf:
[udpoagxml]
MAXEVENTS =
NO
BINARYCHECK = true
category = Custom
description = udp
oagxml
disabled = false
maxDist =
pulldown
type = true

[source::udp:514]
TRANSFORMS-udp = sendtosyslog

transforms.conf:

[sendtosyslog]
REGEX = .
DESTKEY=SYSLOGROUTING
FORMAT=my
syslog_group

outputs.conf:
[syslog:mysysloggroup]
server = x.x.x.x:514
type = udp
priority = NO_PRI

If it's doable ,I would like to know how.

Regards,
Dmitry

0 Karma
Highlighted

Re: UDP routing on indexer

Builder

yes this is doable
sendCookedData = false in outputs.conf and also see this for more information http://docs.splunk.com/Documentation/Splunk/6.2.1/Forwarding/Forwarddatatothird-partysystemsd

0 Karma