Splunk Enterprise

Heavy forwarder configuration

jchermitte
New Member

Bonjour,

J'ai activé le heavy forwarder sur mon Splunk server (8.0.6) afin de pouvoir forwarder des logs vers un serveur tiers avec qradar.

Nous avons identifié 4 sourcetypes pour lesquels forwarder les logs (on ne veut pas tout forwarder).

Or il apparaît que la machine cible reçoit toutes les logs. Je pensais que ma conf du outputs.conf ferait en sorte que seules les logs correspondants à ces sourcetypes seraient forwardées.

Voici le contenu de mon fichier tcpouts.conf :


[syslog]
defaultGroup=syslogGroup

[syslog:syslogGroup]
server = 192.168.152.68:514

[syslog:192.168.152.68:514]
syslogSourceType = f5:bigip:syslog
syslogSourceType = bluecoat:proxysg:access:syslog
syslogSourceType = FO_apache
syslogSourceType = backbone_in

 

Quelqu'un saurait comment filtrer pour ne forwarder que les logs de ces 4 sourcetypes ?

Merci,

Labels (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @jchermitte,

sorry if I answer to you in english (the official language of this Community!) but I know only this language and italian that helped me to understand your question.

Anyway, you have to follow the configurations described at https://docs.splunk.com/Documentation/Splunk/8.2.2/Forwarding/Forwarddatatothird-partysystemsd#Send_...

outputs.conf (not tcpout.conf!)

[syslog:syslogGroup]
server = 192.168.152.68:514

props.conf

[your_sourcetype_1]
TRANSFORMS-syslog = send_to_syslog
[your_sourcetype_2]
TRANSFORMS-syslog = send_to_syslog
[your_sourcetype_3]
TRANSFORMS-syslog = send_to_syslog
[your_sourcetype_4]
TRANSFORMS-syslog = send_to_syslog

transforms.conf

[send_to_syslog]
REGEX = .
DEST_KEY = _SYSLOG_ROUTING
FORMAT = syslogGroup

Ciao.

Giuseppe

0 Karma

jchermitte
New Member

Hi Guiseppe,

Thanks for your answer, i will try this asap.

 

Tags (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @jchermitte,

Ok, let me know and, if the answer solves your need, please accept it foir the other people of Community.

Ciao.

Giuseppe

P.S.: Karma Points are appreciated 😉

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...