I need to forwarded syslog data from a Splunk heavy forwarder to ArcSight. I can forward syslog to one ArcSight connector with no issues, but in order to scale I need to forward data to more than one connector. I cannot get that to work in Splunk.
Currently using 5.0.5 will be upgrading to 6.0.2 in the next couple of weeks.
Data is being forwarded to the first target, but not the second.
We tried it and had a peculiar behavior :
1st attempt : all sourcetypes were forwarded but db data sourcetype
2nd attempt none were forwarded to the second output, yet all were forwarded to the 1st one.
Do you have any idea why?
Any other solutions?
I have not tested this, but could something like this work?
[sourcetype_or_source_of_your_choosing] TRANSFORMS-my_syslog_group = send_to_server1,send_to_server2
[send_to_server1] DEST_KEY = _SYSLOG_ROUTING FORMAT = my_syslog_group1 [send_to_server2] DEST_KEY = _SYSLOG_ROUTING FORMAT = my_syslog_group2
[syslog:my_syslog_group1] server = myhostname1:514 type = tcp [syslog:my_syslog_group2] server = myhostname2:514 type = tcp
Okay - I think the syslog output doesn't support that. You've used the LB syntax that works with tcpout outputs for Splunk receivers, but http://docs.splunk.com/Documentation/Splunk/6.0.2/Admin/outputsconf doesn't mention that ability:
[syslog] defaultGroup = <target_group>, <target_group>, ... [syslog:<target_group>] server = [<ip>|<servername>]:<port>
That doesn't include optional comma-separated LB alternatives 😞