Splunk Enterprise

Forwarding and cloning specific index's to a third party splunk indexer

troyfredmsit
New Member
If a party decided to split all events into their own index's (IE. winevent_security to "security", winevernt_application to "application" etc), but then they had a third party security group that needed specific index's (in this case just the security index). How would one set it up to where that index still goes to the main splunk for the company but ONLY that log goes to the third party splunk as well. The idea is to use a heavy forwarder, but I am not sure how to specify the index. Right now I have all index's going to both but that is not a solution that everyone is comfortable with. Any help would be amazing.
0 Karma

FritzWittwer1
Path Finder

it can be done, see Forwarding/Route and filter data  and CLONE_SOURCETYPE in Transforms.conf . But be warned, it becomes complicated and cumbersome if your rule set is large. You may look into Splunk Data Stream Processor, DSP or also a certain third party product, for a solution which scales.

0 Karma

gjanders
SplunkTrust
SplunkTrust

props.conf:

[thesourcetype]
TRANSFORMS-route = route_to_third_party


transforms.conf:

[route_to_third_party]
SOURCE_KEY = _MetaData:Index
REGEX = ^(winevent)$
DEST_KEY=_TCP_ROUTING
FORMAT = mysplunkinstance, thirdpartyinoutputsconf


Perhaps?

0 Karma
Get Updates on the Splunk Community!

Observability Highlights | November 2022 Newsletter

 November 2022Observability CloudEnd Of Support Extension for SignalFx Smart AgentSplunk is extending the End ...

Avoid Certificate Expiry Issues in Splunk Enterprise with Certificate Assist

This blog post is part 2 of 4 of a series on Splunk Assist. Click the links below to see the other ...

Using Machine Learning for Hunting Security Threats

REGISTER NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more ...