Getting Data In

forwarding syslog to multiple endpoints

Communicator

Hi,

I need to forwarded syslog data from a Splunk heavy forwarder to ArcSight. I can forward syslog to one ArcSight connector with no issues, but in order to scale I need to forward data to more than one connector. I cannot get that to work in Splunk.

Currently using 5.0.5 will be upgrading to 6.0.2 in the next couple of weeks.

outputs.conf

[syslog:arcsight_receiver]
server=xxxxxxx:514, xxxxxxx:514

Data is being forwarded to the first target, but not the second.

Any ideas?

Thanks!

0 Karma

Explorer
0 Karma

Explorer

Hello,

We tried it and had a peculiar behavior :
1st attempt : all sourcetypes were forwarded but db data sourcetype
2nd attempt none were forwarded to the second output, yet all were forwarded to the 1st one.

Do you have any idea why?
Any other solutions?

Best regards

0 Karma

Splunk Employee
Splunk Employee

I have not tested this, but could something like this work?

props.conf:

[sourcetype_or_source_of_your_choosing]
TRANSFORMS-my_syslog_group = send_to_server1,send_to_server2

transforms.conf:

[send_to_server1]
DEST_KEY = _SYSLOG_ROUTING
FORMAT = my_syslog_group1

[send_to_server2]
DEST_KEY = _SYSLOG_ROUTING
FORMAT = my_syslog_group2

outputs.conf:

[syslog:my_syslog_group1]
server = myhostname1:514
type = tcp

[syslog:my_syslog_group2]
server = myhostname2:514
type = tcp
0 Karma

Communicator

Thanks for your help. Looks like I am out of luck.

0 Karma

SplunkTrust
SplunkTrust

Specifying multiple target groups clones the data instead.

0 Karma

Communicator

Thanks - the syntax seemed to imply it would work but I guess not. I saw the format with multiple target groups as the capability I needed.

0 Karma

SplunkTrust
SplunkTrust

Okay - I think the syslog output doesn't support that. You've used the LB syntax that works with tcpout outputs for Splunk receivers, but http://docs.splunk.com/Documentation/Splunk/6.0.2/Admin/outputsconf doesn't mention that ability:

[syslog]
defaultGroup = <target_group>, <target_group>, ...

[syslog:<target_group>]
server = [<ip>|<servername>]:<port>

That doesn't include optional comma-separated LB alternatives 😞

Communicator

load balancing - we need to scale across multiple connectors

Thanks!

0 Karma

SplunkTrust
SplunkTrust

Are you looking for cloning or load balancing?

0 Karma