Getting Data In

forwarding data to another third-party system using Heavy Forwarder

KhalidAlharthi
Explorer

Hello Community,

 

I wondering that i forward the logs using syslog instead of TCP, I received the packets using TcpDump and everything is good but the data not showing there and it's transferred using tcpdump....

 

that's my configuration in HF 

 

Outputs.conf

 

[syslog]
defaultGroup = group2

[syslog:remote_siem]
server = xx.xx.xx.xx:514
sendCookedData = false

transforms.conf

 

[send_tmds_to_remote_siem]
REGEX = .
SOURCE_KEY = _MetaData:Index
DEST_KEY = _SYSLOG_ROUTING
FORMAT = remote_siem


[send_tmao_to_remote_siem]
REGEX = .
SOURCE_KEY = _MetaData:Index
DEST_KEY = _SYSLOG_ROUTING
FORMAT = remote_siem

 

props.conf

[source::udp:1518]
TRANSFORMS-send_tmds_to_remote_siem = send_tmds_to_remote_siem

[source::udp:1517]
TRANSFORMS-send_tmao_to_remote_siem = send_tmao_to_remote_siem

 

is it fine or something not correct please help .

 

 

Labels (2)
0 Karma
Get Updates on the Splunk Community!

Financial Services Industry Use Cases, ITSI Best Practices, and More New Articles ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Splunk Federated Analytics for Amazon Security Lake

Thursday, November 21, 2024  |  11AM PT / 2PM ET Register Now Join our session to see the technical ...

Splunk With AppDynamics - Meet the New IT (And Engineering) Couple

Wednesday, November 20, 2024  |  10AM PT / 1PM ET Register Now Join us in this session to learn all about ...