Heavy forwarder configuration

[jchermitte]

Bonjour,

J'ai activé le heavy forwarder sur mon Splunk server (8.0.6) afin de pouvoir forwarder des logs vers un serveur tiers avec qradar.

Nous avons identifié 4 sourcetypes pour lesquels forwarder les logs (on ne veut pas tout forwarder).

Or il apparaît que la machine cible reçoit toutes les logs. Je pensais que ma conf du outputs.conf ferait en sorte que seules les logs correspondants à ces sourcetypes seraient forwardées.

Voici le contenu de mon fichier tcpouts.conf :

[syslog]
defaultGroup=syslogGroup

[syslog:syslogGroup]
server = 192.168.152.68:514

[syslog:192.168.152.68:514]
syslogSourceType = f5:bigip:syslog
syslogSourceType = bluecoat:proxysg:access:syslog
syslogSourceType = FO_apache
syslogSourceType = backbone_in

Quelqu'un saurait comment filtrer pour ne forwarder que les logs de ces 4 sourcetypes ?

Merci,

[gcusello]

Hi @jchermitte,

sorry if I answer to you in english (the official language of this Community!) but I know only this language and italian that helped me to understand your question.

Anyway, you have to follow the configurations described at https://docs.splunk.com/Documentation/Splunk/8.2.2/Forwarding/Forwarddatatothird-partysystemsd#Send_...

outputs.conf (not tcpout.conf!)

[syslog:syslogGroup]
server = 192.168.152.68:514

props.conf

[your_sourcetype_1]
TRANSFORMS-syslog = send_to_syslog
[your_sourcetype_2]
TRANSFORMS-syslog = send_to_syslog
[your_sourcetype_3]
TRANSFORMS-syslog = send_to_syslog
[your_sourcetype_4]
TRANSFORMS-syslog = send_to_syslog

transforms.conf

[send_to_syslog]
REGEX = .
DEST_KEY = _SYSLOG_ROUTING
FORMAT = syslogGroup

Ciao.

Giuseppe

[jchermitte]

Hi Guiseppe,

Thanks for your answer, i will try this asap.

[gcusello]

Hi @jchermitte,

Ok, let me know and, if the answer solves your need, please accept it foir the other people of Community.

Ciao.

Giuseppe

P.S.: Karma Points are appreciated 😉