forward a subset of existing input

[dhaffner]

I’m trying to take a subset of our regular logs and forward them on to another department.
Am I doing this right? Is the RegEx correct? Do I have the right idea here?

So, what I need to do is forward ONLY the logs that have one of the following in them (this is 4 out of hundreds):

group\geo\country1\*
group\geo\country2\*
group\geo\country3\sub1\*
group\geo\country3\sub12\*

This field is already extracted in transforms.conf as “PathAndName”, but includes hundreds of others as well. (It’s the 3rd last field in the current transforms.conf below)

TRANSFORMS.CONF

Already existing extraction in transforms.conf

[test_extractions]
DELIMS = "|"
FIELDS = "EventID","AlertTime","ThreatInstanceID","ActionTaken","country2erName","Scountry1nnerType","ThreatName","Statcountry2","ThreatType","ThreatSubType","ComputerID","FullFilePath","FileNameOffset","Name","DNSName","IPAddress","OperatingSystem","ServicePack","Vircountry2DataVersion","FullFilePathCheckSum","ThreatLocountry1lID","CheckSum","SAVVersion","DomainName","PathAndName","ParentGroup","SophosDB"

Currently I have the following, but it isn’t working, even though it works great in Expresso and RegexBuddy (as well as about 20 other things!):

[test_to_SSIM]
REGEX= (?i)(?<PathAndName>group\\geo\\country2|group\\geo\\country1|group\\geo\\country3\\sub1|group\\geo\\country3\\sub12)
DEST_KEY=_TCP_ROUTING
FORMAT=test_to_SSIM

PROPS.CONF

[source::existing_feed]
TRANSFORMS-routing = test_to_SSIM

OUTPUTS.CONF

[tcpout:test_to_SSIM]
server=xxx.xxx.xxx.xxx:10595
sendCookedData=false
dropEventsOnQueueFull = 10

[dart]

That all looks correct.

You may want to ensure you set to index and forward in outputs.conf

[default]
indexAndForward=true

See more examples at the splunk documentation