Why is Splunk forwarder is not forwarding events?

[kvmuralidhar]

Hi,

We have installed Splunk to forward audit logs from LDAP to server02 and are not getting any events from the server. The logs are filtered and forwarded correctly to server01 just not to server02. Is this because server02 is not defined in the defaultgroup ?

Please advice.

Here are the configuration files.

Inputs.conf (Entry)
[monitor:///logsa/audit.log]
source = IT-LDAP-audit-ldapdb2
sourcetype = IT-LDAP-audit_entry
disabled = false

Outputs.conf
[tcpout]
defaultGroup = default-clone-group-server01_9997
disabled = false
isLoadBalanced = False
maxQueueSize = 1000
indexAndForward = false

[tcpout:server02_1536]
disabled = false
server = server02.com:1536

[props.conf]
[IT-LDAP-audit_entry]
TIME_PREFIX = ^AuditV3--
TIME_FORMAT = %Y-%m-%d-%H:%M:%S
TZ = US/Eastern
BREAK_ONLY_BEFORE = ^AuditV3--
TRANSFORMS-skip = knownldapaudit
TRANSFORMS-routing = arcsightldapnp

[transform.conf]
[arcsightldapnp]
REGEX = Invalid credentials
DEST_KEY = _TCP_ROUTING
FORMAT = arcsightldapnpreader

[strive]

Yes you need to specify it in default group.

Splunk documentation says -- * Starting with 4.2, this attribute is no longer required. But somehow this doesn't work.

[kvmuralidhar]

Hi Steve,

Sorry for the delayed response. It did not work. Here is the relevant info from props.conf, outputs.conf, & transforms.conf file.

props.conf entry
[IT-LDAP-audit_entry]
TIME_PREFIX = ^AuditV3--
TIME_FORMAT = %Y-%m-%d-%H:%M:%S
TZ = US/Eastern
BREAK_ONLY_BEFORE = ^AuditV3--
TRANSFORMS-routing = arcsightldapnp

Transforms.conf entry
[arcsightldapnp]
REGEX = .
DEST_KEY = _TCP_ROUTING
FORMAT = arcsightldapnpreader

Outputs.conf

[tcpout:arcsightldapnpreader]
disabled = false
server = servername:1536

Thanks in advance for your help

Murali

[strive]

Did it work?

[kvmuralidhar]

Hi Strive,

Thank your for your quick response.

Murali