Forward all data to third party Splunk using index

[blake1987]

Hi,

I'm trying to forward all data received by one indexer to a third party Indexer, but rewriting the index for the data sent to the third party.

Everything is configured to come in from the UF's using specific index's (Such as WinEventLog). SplunkA indexes the data into those index's happily.

There is a requirement to forward all data to SplunkB, but to a dedicated index (Such as SubsidiaryIndex instead of WinEventLog). I was originally using IndexandForward in an outputs.conf, but the forwarded data includes the index set by the UF's.

The guide here is close to what I want to do, but I want it to forward all data, and rewrite the index - https://docs.splunk.com/Documentation/Splunk/8.0.5/Forwarding/Routeandfilterdatad#Replicate_a_subset... 

props.conf - Note: I feel like the default stanza is wrong, but I'm not sure how else to capture everything. Also, I've tried TRANSFORMS-routing and TRANSFORMS-forward...

[default]
TRANSFORMS-routing = routeAll

transforms.conf

[routeAll]
REGEX=(.)
DEST_KEY = _MetaData:Index
FORMAT = SubsidiaryIndex
DEST_KEY=_TCP_ROUTING
FORMAT=Subsidiary

outputs.conf

outputs.conf
[tcpout]
defaultGroup=nothing

[tcpout:Subsidiary]
disabled=false
sendCookedData=false
server=169.254.153.83:9999

Any guidance would really be appreciated! 

[thambisetty]

ok no problem. have same outputs.conf on HF

in inputs.conf of HF:

[default]
_TCP_ROUTING = yourown,Subsidiary

you need to create multiple stanza for each sourcetype in windows index events.

[sourcetype]
REGEX = .*
DEST_KEY = _MetaData:Index
FORMAT = Doors

[blake1987]

Thanks @thambisetty , I see where you're going. The only issue is I need to re-write the index on the forwarded logs, instead of forwarding them with the index set on outputs.conf on the universal forwarder tagged them with.

I'm having a hard time explaining it clearly sorry. Something like this:

UF (Sets Index to Windows) --> IndexerA (Indexes to Index Windows, and forwards to IndexerB using index Doors) --> IndexerB (Indexes to Index Doors)

Thanks agian!

[thambisetty]

@blake1987 

check my updated answer. hope you have understood how to parse. I have updated now how to change index.

[thambisetty]

have one more stanza in outputs.conf 

[tcpout]
defaultGroup=yourown

[tcpout:yourown]
server=ip:port

[tcpout:Subsidiary]
server=169.254.153.83:9999

inputs.conf : for example

[WinEventLog://Security]
_TCP_ROUTING = yourown,Subsidiary

everything from the client where the above configurations configured will be sent to defaultGroup. but WinEventLog://Security will be forwarded to default AND Subsidiary as well.

[blake1987]

Thanks @thambisetty 

 My problem is that I'm trying to forward all data, not just a single sorucetype from the Indexer/Heavy Forwarder.