Getting Data In

Overriding indexes of sources in SC4S

MediumToast
Engager

Hi,

Apologies if I'm using the wrong terminology here.

I'm trying to configure SC4S to override the destination indexes of types of sources. For example, if an event is received from a Cisco firewall by default it'll end up in the 'netfw' index. Instead, I want all events that would have gone to 'netfw' to go to, for example, 'site1_netfw'.

I attempted to do this using the splunk_metadata.csv file but I now understand I've misinterpreted the documentation. I had used 'netfw,index,site1_netfw' but if I understand correctly, I'd actually need to have a seperate line for each key such as 'cisco_asa,index,site1_netfw'. Is that correct? Is there a way to accomplish what I want without listing each source key?

Thanks

Labels (1)
Tags (1)
0 Karma
1 Solution

MediumToast
Engager

Thanks for the response.

Maciek Stopa on the Splunk Slack workspace provided this novel code that has worked well. This doesn't handled the metrics and sc4s events but I handled those in splunk_metadata.csv.

# cp example_postfiler.conf /opt/sc4s/local/config/app_parsers/
# systemctl restart sc4s

block parser app-dest-rewrite-index() {
    channel {
        rewrite {
            r_set_splunk_dest_update_v2(
                index("${.splunk.index}_unique-suffix")
            );
        };
    };
};

application app-dest-rewrite-index[sc4s-postfilter] {
    parser { app-dest-rewrite-index(); };
};

 

 

View solution in original post

0 Karma

KendallW
Contributor

Hi @MediumToast 
If you only specify netfw,index,site1_netfw, it will not apply to all events from sources that are configured to be sent to the netfw index. It will only apply to events with the exact key netfw.

Also, SC4S does not support wildcards in the splunk_metadata.csv file, so each sourcetype must be explicitly defined. If you have multiple Cisco devices (or any other types) that you want to redirect to site1_netfw, you will need to list each one individually. 

You could get around this by updating the compliance_meta_by_source.conf and compliance_meta_by_source.csv files, e.g. like this (please test)

compliance_meta_by_source.conf:

 

filter f_netfw_sources {
    program("cisco_asa" type(string)) or
    program("cisco_ios" type(string)) or
    program("cisco_nexus" type(string)) or
    program("juniper_netscreen" type(string))
    # Add other relevant network firewall source types here
};

 


compliance_meta_by_source.csv

 

f_netfw_sources,.splunk.index,site1_netfw

 

 

 

0 Karma

MediumToast
Engager

Thanks for the response.

Maciek Stopa on the Splunk Slack workspace provided this novel code that has worked well. This doesn't handled the metrics and sc4s events but I handled those in splunk_metadata.csv.

# cp example_postfiler.conf /opt/sc4s/local/config/app_parsers/
# systemctl restart sc4s

block parser app-dest-rewrite-index() {
    channel {
        rewrite {
            r_set_splunk_dest_update_v2(
                index("${.splunk.index}_unique-suffix")
            );
        };
    };
};

application app-dest-rewrite-index[sc4s-postfilter] {
    parser { app-dest-rewrite-index(); };
};

 

 

0 Karma
Get Updates on the Splunk Community!

Federated Search for Amazon S3 | Key Use Cases to Streamline Compliance Workflows

Modern business operations are supported by data compliance. As regulations evolve, organizations must ...

New Dates, New City: Save the Date for .conf25!

Wake up, babe! New .conf25 dates AND location just dropped!! That's right, this year, .conf25 is taking place ...

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...