splunk forwarder

[heterodyned]

I am planning to integrate Splunk data with MARS, would the cloning option work for Non-Splunk receiver as well? Or is it possible I could clone the data bein forwarded to its own Syslog, I can pull events from syslog accordingly....

[Jag · Accepted solution]

You can forward data to cloned targets, where targets can be either splunk instance or a device receiving TCP stream. In addition, you can also forward data to syslog target as well.

The following configuration should enable cloning as well as forwarding via syslog. Set the following in outputs.conf:

[tcpout]
defaultGroup = group1, group2   # Clone data to group1 and group2

[tcpout:group1]
server = indexer1:9997

[tcpout:group2]
server = indexer2:9997
sendCookedData = false          # Send raw TCP data(logs read by splunk)

# Define syslog to send data to syslog target
[syslog]
defaultgroup = syslogGroup1

[syslog:syslogGroup1]
server = syslogServer:514

# This prevents local indexing. To enable indexing, set index = true
[indexAndForward]
index = false

[dskillman]

I'm not sure you can use native Splunk forwarding to clone data to a MARS device. If MARS can accept the data via a TCP stream (rather than UDP) and you want to send all data to MARS than you will need to turn off 'cooked data'. (by default, The forwarder mechanism expects a Splunk server on the other end). Either way I think what you are looking for can be found at:

http://www.splunk.com/base/Documentation/4.1.2/Admin/Forwarddatatothird-partysystems

[heterodyned]

I was trying to forward syslog events collectively from Splunk Forwarder to Cisco MARS, MARS requires individually configuring all the linux boxes to MARS, where as splunk is already configured to receive these syslog messages, I was jus trying to route that data to MARS ....I guess I shouldnt be doing it there is a basic compatibitility issue between these two application/device

[dskillman]

Not sure what you're trying to accomplish. What is the SplunkForwarder collecting? Is it getting data sent to it? Or are you tailing files? What data do you want sent to MARS?

[heterodyned]

Is it possible otherwise, if the splunkforwarder can send syslog events to itself?? I wasnt able to configure MARS to accept tcp/udp connections on the fly with splunkforwarder....