forwarding syslog to multiple endpoints

[ebailey]

Hi,

I need to forwarded syslog data from a Splunk heavy forwarder to ArcSight. I can forward syslog to one ArcSight connector with no issues, but in order to scale I need to forward data to more than one connector. I cannot get that to work in Splunk.

Currently using 5.0.5 will be upgrading to 6.0.2 in the next couple of weeks.

outputs.conf

[syslog:arcsight_receiver]
server=xxxxxxx:514, xxxxxxx:514

Data is being forwarded to the first target, but not the second.

Any ideas?

Thanks!

[SarahSplunk123]

Hey,

It can be done as in Dan's post :
http://answers.splunk.com/answers/4083/can-i-route-some-data-as-syslog-output-to-multiple-destinatio...

Best regards

[SarahSplunk123]

Hello,

We tried it and had a peculiar behavior :
1st attempt : all sourcetypes were forwarded but db data sourcetype
2nd attempt none were forwarded to the second output, yet all were forwarded to the 1st one.

Do you have any idea why?
Any other solutions?

Best regards

[dmaislin_splunk]

I have not tested this, but could something like this work?

props.conf:

[sourcetype_or_source_of_your_choosing]
TRANSFORMS-my_syslog_group = send_to_server1,send_to_server2

transforms.conf:

[send_to_server1]
DEST_KEY = _SYSLOG_ROUTING
FORMAT = my_syslog_group1

[send_to_server2]
DEST_KEY = _SYSLOG_ROUTING
FORMAT = my_syslog_group2

outputs.conf:

[syslog:my_syslog_group1]
server = myhostname1:514
type = tcp

[syslog:my_syslog_group2]
server = myhostname2:514
type = tcp

[ebailey]

Thanks for your help. Looks like I am out of luck.

[martin_mueller]

Specifying multiple target groups clones the data instead.

[ebailey]

Thanks - the syntax seemed to imply it would work but I guess not. I saw the format with multiple target groups as the capability I needed.

[martin_mueller]

Okay - I think the syslog output doesn't support that. You've used the LB syntax that works with tcpout outputs for Splunk receivers, but http://docs.splunk.com/Documentation/Splunk/6.0.2/Admin/outputsconf doesn't mention that ability:

[syslog]
defaultGroup = <target_group>, <target_group>, ...

[syslog:<target_group>]
server = [<ip>|<servername>]:<port>

That doesn't include optional comma-separated LB alternatives 😞

[ebailey]

load balancing - we need to scale across multiple connectors

Thanks!

[martin_mueller]

Are you looking for cloning or load balancing?