Installation

Not to send the particular logs to specific target

pankajupadhyay
Path Finder

Hi,

I want to send all the event to two target group but do not want spend specific log event to specific target but it should get rest of the data. 

This config need to be define on Splunk HF.

Please help me in that.

Labels (3)

493669
Super Champion

@pankajupadhyay 
Refer Splunk Docs-https://docs.splunk.com/Documentation/Splunk/8.0.6/Forwarding/Routeandfilterdatad#Filter_and_route_e... 

This contains exactly what you are referring in question.  let us know if it helps!

0 Karma

pankajupadhyay
Path Finder

@493669 

 

I wanna forward these speicifi events only to target destination but it is senidng other event too.

Transforms.conf
[logs_type1]
REGEX = (logged out|Rejected password for user|Cannot login|logged in as|Accepted user for user|was updated on host|Password was changed for account|Destroy VM called)
DEST_KEY = _TCP_ROUTING
FORMAT = esxireceivier

 

Props.conf

[vmw_logs]
TRANSFORMS-routing=logs_type1

 

 

 

Can you please help me in that ?

0 Karma

vikramyadav
Contributor

Hi @pankajupadhyay , you can specify the destination host in outputs.conf

eg:-
outputs.conf

[tcpout:esxireceivier]

server=your_destination_ip:port

--------------------------------------------------------

If this helps your like will be appreciated😀

 

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...