Getting Data In

forwarder Logs

splkadmin
Explorer

Hi,

 I am forwarding  logs to indexer and  also to third party server  from my universal forwarder

I am sure what we are configured on inputs.conf  that only logs will send to indexer

Now I have added another third party server on my  outputs.conf , so my question will it sent whole logs or only the inputs.conf file log ..?

 

Labels (1)
0 Karma
1 Solution

isoutamo
SplunkTrust
SplunkTrust

With your current configuration it sends all logs to the both target (indexer and syslog).

If you want to send some logs to both and some to only one then you need remove remote-server from default and add into inputs.conf _SYSLOG_ROUTING = <remote group stanza name in outputs.conf for syslog target> to send only that one. That must do on every monitoring stanza. 

https://docs.splunk.com/Documentation/Splunk/7.3.3/Admin/Inputsconf

There is also _TCP_ROUTING parameter which is used with indexers.

 

View solution in original post

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Can you paste your inputs.conf and outputs.conf here with masked sensitive information? Then it's easier help you.

r. Ismo

0 Karma

splkadmin
Explorer

Pls find the info below

cat splunkforwarder/etc/apps/search/local/inputs.conf
[monitor:///var/log]
disabled = false
index = linux
sourcetype = linux_logs

[monitor:///vitent/skipper/logs.log]
disabled = false
index = linux
sourcetype = linux_logs


sudo cat splunkforwarder/etc/system/local/outputs.conf
[tcpout]
defaultGroup = default-autolb-group,thirdparty

[tcpout:default-autolb-group]
server = 10.x.x.1:9997

[tcpout-server://10.x.x.1:9997]

[tcpout:thirdparty]
server = 10.x.x.x:514
sendCookedData = false

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Thanks. This configuration seems to be correct.

1) send to splunk idx

2) send to syslog server with udp to port 514

Actually you could drop away [tcpout-server://10.x.x.1:9997] as you don't define anything there.

So what was your actual issue?

0 Karma

splkadmin
Explorer

send to syslog server with udp to port 514

I want to know  what are the logs will  sent to syslog server through universal forwarder to thirdy party? only the logs I defined in inputs.conf  ?

0 Karma

isoutamo
SplunkTrust
SplunkTrust

With your current configuration it sends all logs to the both target (indexer and syslog).

If you want to send some logs to both and some to only one then you need remove remote-server from default and add into inputs.conf _SYSLOG_ROUTING = <remote group stanza name in outputs.conf for syslog target> to send only that one. That must do on every monitoring stanza. 

https://docs.splunk.com/Documentation/Splunk/7.3.3/Admin/Inputsconf

There is also _TCP_ROUTING parameter which is used with indexers.

 

View solution in original post

0 Karma