Splunk Search

How can I pipe search results to syslog?

grantsales
Engager

Example:

I'd like to run a search on windows logs, do some data transformation and then pipe the output to a syslog listener not on the local host.

sourcetype="WinEventLog:Security" EventCode=4624 Logon_Type=2 |  Send to syslog IP 10.0.0.12:514
0 Karma

dart
Splunk Employee
Splunk Employee

The Splunk App for CEF demonstrates one way of doing this.

0 Karma

grantsales
Engager

Thanks, but I am looking for an alternative to this app.

My current tools are limited to "Searching and Reporting" App and any python scripts I can put on the server.

0 Karma

MuS
SplunkTrust
SplunkTrust

This maybe sounds strange in the first place; but how about using the route and filter method in props.conf like written in the docs http://docs.splunk.com/Documentation/Splunk/6.2.1/Forwarding/Routeandfilterdatad#Replicate_a_subset_...
Use as regex something like this REGEX = .+EventCode=4624.+Logon_Type=2 and set it on the sourcetype [WinEventLog:Security]

0 Karma

grantsales
Engager

I didn't even know you could do that, it's possible that it could work, my fields are using the Windows app for splunk so I'm not sure if I'd be able to use that regex. Thanks for the tip.

0 Karma
Get Updates on the Splunk Community!

Happy CX Day to our Community Superheroes!

Happy 10th Birthday CX Day!What is CX Day? It’s a global celebration recognizing innovation and success in the ...

Check out This Month’s Brand new Splunk Lantern Articles

Splunk Lantern is a customer success center providing advice from Splunk experts on valuable data insights, ...

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...