Splunk Search

How can I index logs to a specific splunk cloud?

zcx01067
Explorer

Hi there, If I have several splunk clouds and a heavy forwarder on-premise, how can I configure the heavy forwarder to send specific logs to a specific splunk cloud?

Labels (1)
Tags (1)
0 Karma

shivanshu1593
Builder

Can be achieved via the magic of props, transforms and outputs.conf on a heavy forwarder. Here are the steps.

  • Select the log source, find its metadata value (host, source or sourcetype)
  • in props.conf (Under the app where your inputs is kept or under system/local), put the following

 

[yoursourectype/host/source]
TRANSFORMS-routing=route_data_to_region1
TRANSFORMS-routing1=route_data_to_region2
TRANSFORMS-routing2=route_data_to_region3

 

  • In the same directory, under transforms.conf, please put the following:

 

[route_data_to_region1]
REGEX=<Your regex to match the data that you want to send to this region>
DEST_KEY=_TCP_ROUTING
FORMAT=target_group1 #You can name the target group name mentioned in the outputs.conf of this region as well

[route_data_to_region2]
REGEX=<Your regex to match the data that you want to send to this region>
DEST_KEY=_TCP_ROUTING
FORMAT=target_group2

[route_data_to_region3]
REGEX=<Your regex to match the data that you want to send to this region>
DEST_KEY=_TCP_ROUTING
FORMAT=target_group3

 

  • Now in outputs.conf under the same directory, you can route the data to your different SplunkCloud regions. Since its SplunkCloud, please add the certificate path and key like the one present in the certificate app.

 

[tcpout:target_group1]
server=<ip>:<port> #Enter your indexers' IP address and details
#Add more details like cert's path (Provided by Splunk for Splunkcloud) for TLS handshake, key's path and other configs as required.

[tcpout:target_group2]
server=<ip>:<port>

[tcpout:target_group3]
server=<ip>:<port>​

 

  • Restart splunk service on the HF and the data routing shall begin.

 

Hope this helps,

##If this helps, please consider an upvote/accepting as an answer###

Thank you,
Shiv
###If you found the answer helpful, kindly consider upvoting/accepting it as the answer as it helps other Splunkers find the solutions to similar issues###
Get Updates on the Splunk Community!

Welcome to the Future of Data Search & Exploration

You have more data coming at you than ever before. Over the next five years, the total amount of digital data ...

What’s new on Splunk Lantern in August

This month’s Splunk Lantern update gives you the low-down on all of the articles we’ve published over the past ...

This Week's Community Digest - Splunk Community Happenings [8.3.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...