Getting Data In

forwarding syslog to multiple endpoints

ebailey
Communicator

Hi,

I need to forwarded syslog data from a Splunk heavy forwarder to ArcSight. I can forward syslog to one ArcSight connector with no issues, but in order to scale I need to forward data to more than one connector. I cannot get that to work in Splunk.

Currently using 5.0.5 will be upgrading to 6.0.2 in the next couple of weeks.

outputs.conf

[syslog:arcsight_receiver]
server=xxxxxxx:514, xxxxxxx:514

Data is being forwarded to the first target, but not the second.

Any ideas?

Thanks!

0 Karma

SarahSplunk123
Explorer
0 Karma

SarahSplunk123
Explorer

Hello,

We tried it and had a peculiar behavior :
1st attempt : all sourcetypes were forwarded but db data sourcetype
2nd attempt none were forwarded to the second output, yet all were forwarded to the 1st one.

Do you have any idea why?
Any other solutions?

Best regards

0 Karma

dmaislin_splunk
Splunk Employee
Splunk Employee

I have not tested this, but could something like this work?

props.conf:

[sourcetype_or_source_of_your_choosing]
TRANSFORMS-my_syslog_group = send_to_server1,send_to_server2

transforms.conf:

[send_to_server1]
DEST_KEY = _SYSLOG_ROUTING
FORMAT = my_syslog_group1

[send_to_server2]
DEST_KEY = _SYSLOG_ROUTING
FORMAT = my_syslog_group2

outputs.conf:

[syslog:my_syslog_group1]
server = myhostname1:514
type = tcp

[syslog:my_syslog_group2]
server = myhostname2:514
type = tcp
0 Karma

ebailey
Communicator

Thanks for your help. Looks like I am out of luck.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Specifying multiple target groups clones the data instead.

0 Karma

ebailey
Communicator

Thanks - the syntax seemed to imply it would work but I guess not. I saw the format with multiple target groups as the capability I needed.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Okay - I think the syslog output doesn't support that. You've used the LB syntax that works with tcpout outputs for Splunk receivers, but http://docs.splunk.com/Documentation/Splunk/6.0.2/Admin/outputsconf doesn't mention that ability:

[syslog]
defaultGroup = <target_group>, <target_group>, ...

[syslog:<target_group>]
server = [<ip>|<servername>]:<port>

That doesn't include optional comma-separated LB alternatives 😞

ebailey
Communicator

load balancing - we need to scale across multiple connectors

Thanks!

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Are you looking for cloning or load balancing?

0 Karma
Get Updates on the Splunk Community!

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

Getting Started with AIOps: Event Correlation Basics and Alert Storm Detection in ...

Getting Started with AIOps:Event Correlation Basics and Alert Storm Detection in Splunk IT Service ...

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...