Splunk Enterprise

Heavy forwarder configuration

jchermitte
New Member

Bonjour,

J'ai activé le heavy forwarder sur mon Splunk server (8.0.6) afin de pouvoir forwarder des logs vers un serveur tiers avec qradar.

Nous avons identifié 4 sourcetypes pour lesquels forwarder les logs (on ne veut pas tout forwarder).

Or il apparaît que la machine cible reçoit toutes les logs. Je pensais que ma conf du outputs.conf ferait en sorte que seules les logs correspondants à ces sourcetypes seraient forwardées.

Voici le contenu de mon fichier tcpouts.conf :


[syslog]
defaultGroup=syslogGroup

[syslog:syslogGroup]
server = 192.168.152.68:514

[syslog:192.168.152.68:514]
syslogSourceType = f5:bigip:syslog
syslogSourceType = bluecoat:proxysg:access:syslog
syslogSourceType = FO_apache
syslogSourceType = backbone_in

 

Quelqu'un saurait comment filtrer pour ne forwarder que les logs de ces 4 sourcetypes ?

Merci,

Labels (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @jchermitte,

sorry if I answer to you in english (the official language of this Community!) but I know only this language and italian that helped me to understand your question.

Anyway, you have to follow the configurations described at https://docs.splunk.com/Documentation/Splunk/8.2.2/Forwarding/Forwarddatatothird-partysystemsd#Send_...

outputs.conf (not tcpout.conf!)

[syslog:syslogGroup]
server = 192.168.152.68:514

props.conf

[your_sourcetype_1]
TRANSFORMS-syslog = send_to_syslog
[your_sourcetype_2]
TRANSFORMS-syslog = send_to_syslog
[your_sourcetype_3]
TRANSFORMS-syslog = send_to_syslog
[your_sourcetype_4]
TRANSFORMS-syslog = send_to_syslog

transforms.conf

[send_to_syslog]
REGEX = .
DEST_KEY = _SYSLOG_ROUTING
FORMAT = syslogGroup

Ciao.

Giuseppe

0 Karma

jchermitte
New Member

Hi Guiseppe,

Thanks for your answer, i will try this asap.

 

Tags (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @jchermitte,

Ok, let me know and, if the answer solves your need, please accept it foir the other people of Community.

Ciao.

Giuseppe

P.S.: Karma Points are appreciated 😉

0 Karma
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...