forwarder Logs

[splkadmin]

Hi,

 I am forwarding  logs to indexer and  also to third party server  from my universal forwarder

I am sure what we are configured on inputs.conf  that only logs will send to indexer

Now I have added another third party server on my  outputs.conf , so my question will it sent whole logs or only the inputs.conf file log ..?

[isoutamo]

Can you paste your inputs.conf and outputs.conf here with masked sensitive information? Then it's easier help you.

r. Ismo

[splkadmin]

Pls find the info below

cat splunkforwarder/etc/apps/search/local/inputs.conf
[monitor:///var/log]
disabled = false
index = linux
sourcetype = linux_logs

[monitor:///vitent/skipper/logs.log]
disabled = false
index = linux
sourcetype = linux_logs

sudo cat splunkforwarder/etc/system/local/outputs.conf
[tcpout]
defaultGroup = default-autolb-group,thirdparty

[tcpout:default-autolb-group]
server = 10.x.x.1:9997

[tcpout-server://10.x.x.1:9997]

[tcpout:thirdparty]
server = 10.x.x.x:514
sendCookedData = false

[isoutamo]

Thanks. This configuration seems to be correct.

1) send to splunk idx

2) send to syslog server with udp to port 514

Actually you could drop away [tcpout-server://10.x.x.1:9997] as you don't define anything there.

So what was your actual issue?

[splkadmin]

send to syslog server with udp to port 514

I want to know  what are the logs will  sent to syslog server through universal forwarder to thirdy party? only the logs I defined in inputs.conf  ?

[isoutamo · Accepted solution]

With your current configuration it sends all logs to the both target (indexer and syslog).

If you want to send some logs to both and some to only one then you need remove remote-server from default and add into inputs.conf _SYSLOG_ROUTING = <remote group stanza name in outputs.conf for syslog target> to send only that one. That must do on every monitoring stanza. 

https://docs.splunk.com/Documentation/Splunk/7.3.3/Admin/Inputsconf

There is also _TCP_ROUTING parameter which is used with indexers.