Getting Data In

Using Splunk UF to send data to ELK

Na_Kang_Lim
Path Finder

Hi, as the question suggest, I am trying to send 2 streams of logs.

From the document Forward data to third-party systems - Splunk Documentation I know there are 2 limitations:
- I can only send raw data

- I cannot filter only the data I want

So sending all data is OK for me.

Currently, my UF have this app called INDEXER_OUTPUT. Which in its default/outputs.conf have these configs:

 

[tcpout]
defaultGroup=my_indexer_cluster
autoLBFrequency=300

[tcpout:my_indexer_cluster]
server=<indexer_01_ip>:9997,<indexer_02_ip>:9997,<indexer_03_ip>:9997,<indexer_04_ip>:9997

[tcpout-server://<indexer_01_ip>:9997]

[tcpout-server://<indexer_02_ip>:9997]

[tcpout-server://<indexer_03_ip>:9997]

[tcpout-server://<indexer_04_ip>:9997]

 

So what I did was created another server class, with a single app within called ELK_OUTPUT. It also has a single default/outputs.conf file with this config:

 

[tcpout]

[tcpout:elk_server]
server=<elk_server_ip>:3514
sendCookedData=false

 

Upon adding the client to the server class, what I noticed is a weird behavior:
I only get the metrics.log sent to the ELK server

What I am suspecting is that maybe because my [WinEventLog://Security] input stanza contains "renderXML = true" and "evt_resolve_ad_obj = 1", so that it no longer considered as "raw data"?

0 Karma

livehybrid
Ultra Champion

Hi @Na_Kang_Lim 

You will also need to update the 

defaultGroup=my_indexer_cluster

to 

defaultGroup=my_indexer_cluster,elk_server

so that it sends to both. The reason that you are getting the metrics is that some inputs.conf such as splunk.version monitor stanza has "_TCP_ROUTING = *" which sends to all output groups.

You will need to either make the change in the app where the defaultGroup is already defined, or push it out through another app which has a higher order of precedence. It might be easiest to change this in the existing app if possible. 

:glowing_star: Did this answer help you? If so, please consider:

  • Adding karma to show it was useful
  • Marking it as the solution if it resolved your issue
  • Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...