Getting Data In

forwarder Logs

splkadmin
Explorer

Hi,

 I am forwarding  logs to indexer and  also to third party server  from my universal forwarder

I am sure what we are configured on inputs.conf  that only logs will send to indexer

Now I have added another third party server on my  outputs.conf , so my question will it sent whole logs or only the inputs.conf file log ..?

 

Labels (1)
0 Karma
1 Solution

isoutamo
SplunkTrust
SplunkTrust

With your current configuration it sends all logs to the both target (indexer and syslog).

If you want to send some logs to both and some to only one then you need remove remote-server from default and add into inputs.conf _SYSLOG_ROUTING = <remote group stanza name in outputs.conf for syslog target> to send only that one. That must do on every monitoring stanza. 

https://docs.splunk.com/Documentation/Splunk/7.3.3/Admin/Inputsconf

There is also _TCP_ROUTING parameter which is used with indexers.

 

View solution in original post

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Can you paste your inputs.conf and outputs.conf here with masked sensitive information? Then it's easier help you.

r. Ismo

0 Karma

splkadmin
Explorer

Pls find the info below

cat splunkforwarder/etc/apps/search/local/inputs.conf
[monitor:///var/log]
disabled = false
index = linux
sourcetype = linux_logs

[monitor:///vitent/skipper/logs.log]
disabled = false
index = linux
sourcetype = linux_logs


sudo cat splunkforwarder/etc/system/local/outputs.conf
[tcpout]
defaultGroup = default-autolb-group,thirdparty

[tcpout:default-autolb-group]
server = 10.x.x.1:9997

[tcpout-server://10.x.x.1:9997]

[tcpout:thirdparty]
server = 10.x.x.x:514
sendCookedData = false

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Thanks. This configuration seems to be correct.

1) send to splunk idx

2) send to syslog server with udp to port 514

Actually you could drop away [tcpout-server://10.x.x.1:9997] as you don't define anything there.

So what was your actual issue?

0 Karma

splkadmin
Explorer

send to syslog server with udp to port 514

I want to know  what are the logs will  sent to syslog server through universal forwarder to thirdy party? only the logs I defined in inputs.conf  ?

0 Karma

isoutamo
SplunkTrust
SplunkTrust

With your current configuration it sends all logs to the both target (indexer and syslog).

If you want to send some logs to both and some to only one then you need remove remote-server from default and add into inputs.conf _SYSLOG_ROUTING = <remote group stanza name in outputs.conf for syslog target> to send only that one. That must do on every monitoring stanza. 

https://docs.splunk.com/Documentation/Splunk/7.3.3/Admin/Inputsconf

There is also _TCP_ROUTING parameter which is used with indexers.

 

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...