forward logs from HF to third-party using syslog

[KhalidAlharthi]

i have used this approach to forward logs from specific index to third-party system in my case Qradar

so i need to do the same forwarding specific index using syslog not TCP cuz it's takes time ( i did tcpdump to figure that)

this approach i follow 

# props.conf

[default]
TRANSFORMS-send_foo_to_remote_siem

# transforms.conf

[send_foo_to_remote_siem]
REGEX = foo
SOURCE_KEY = _MetaData:Index
DEST_KEY = _TCP_ROUTING
FORMAT = remote_siem

# outputs.conf

[tcpout:remote_siem]
server = remotesiem:1234
sendCookedData = false

thanks

[gcusello]

Hi @KhalidAlharthi ,

does it run your solution?

I found an error: the transformation is missed in the props.conf.

I'm not sure that you can put the TRANSFORMS in Default stanza and I don't like to use a regex on index field, I'd use a different approach:

# props.conf

[your_sourcetype]
TRANSFORMS-send_foo_to_remote_siem = send_foo_to_remote_siem

# transforms.conf

[send_foo_to_remote_siem]
REGEX = .
DEST_KEY = _TCP_ROUTING
FORMAT = remote_siem

# outputs.conf

[tcpout:remote_siem]
server = remotesiem:1234
sendCookedData = false

then put attention to the sourcetype: you must be sure that you are using, in the props.conf, the original sourcetype and not a transformed (by the add-on) one.

 Ciao.

Giuseppe

[KhalidAlharthi]

by this you are sending all the event to remote siem 

i need to send just TMAO trend micro 

soo what the best approach to do this using syslog ...

[gcusello · Accepted solution]

Hi @KhalidAlharthi ,

in props.conf, you have to use only the sourcetype of the logs to send to syslog.

If they are more than one, put more stanzas in props.

# props.conf

[TMAO_sourcetype]
TRANSFORMS-send_foo_to_remote_siem = send_foo_to_remote_siem

# transforms.conf

[send_foo_to_remote_siem]
REGEX = .
DEST_KEY = _TCP_ROUTING
FORMAT = remote_siem

# outputs.conf

[tcpout:remote_siem]
server = remotesiem:1234
sendCookedData = false

AS I said, check the exact sourcetype name: I recently solved an issue near your, where the error was the sourcetype exact name.

Ciao.

Giuseppe

[KhalidAlharthi]

Thanks @gcusello 

is it possible to define it like what you did 

[TMAO_sourcetype]

and if yes sourcetype of data source right?

[gcusello]

Hi @KhalidAlharthi ,

yes (I saw your other question!).

let me know if I can help you more, or, please, accept one answer for the other people of Community.

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉

[KhalidAlharthi]

yeah i picked your solution.

could you please check your DM

[gcusello]

Hi @KhalidAlharthi ,

what do you mean with "DM"?

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉

[malisushil119]

We have installed Splunk in windows and we want to send windows logs from Search Head, LM and CM to 3rd party using an indexer, somehow those logs can be seen in Search head queries but indexer is not forwarding them to 3rd party.

[gcusello]

Hi @malisushil119 ,

don't attach a new post to another one, even if on the same topic because you'll receive a faster and probably better answer.

Ciao.

Giuseppe

[KhalidAlharthi]

@gcusello I sent you private message .