We have a Splunk Enterprise (single instance) and collect logs from all network devices and operating systems, recently we have to send all logs as syslog to a 3rd party syslog-server so we configured transforms.conf, outputs.conf and props.conf and now every log are sending to that server.
But now we need to add SourceType of the event to the event's body in order to events be distinguishable at syslog server. For example we need to append "iis" to head of iis events or add "apache" to events with sourcetype of access_combined before sending to 3rd party syslog server.
There is no limitation in solution, we can add a fixed string for each sourcetype or exact sourcetype of the event to the event body.
Please help me to configure props, transforms and output files.
Here are my conf files:
props.conf
[WinEventLog:Security]
TRANSFORMS-WinEventLog=send_to_syslog
[WinEventLog:System]
TRANSFORMS-WinEventLog=send_to_syslog
...(other sourcetypes)
transforms.conf
[send_to_syslog]
REGEX = .
DEST_KEY = _SYSLOG_ROUTING
FORMAT = syslog_3rd
output.conf:
[syslog:syslog_3rd]
type = udp
server = 3rdPartyIP:514
[tcpout]
indexAndForward = 0
Thanks.
... View more