Getting Data In

forwarding syslog to multiple endpoints

ebailey
Communicator

Hi,

I need to forwarded syslog data from a Splunk heavy forwarder to ArcSight. I can forward syslog to one ArcSight connector with no issues, but in order to scale I need to forward data to more than one connector. I cannot get that to work in Splunk.

Currently using 5.0.5 will be upgrading to 6.0.2 in the next couple of weeks.

outputs.conf

[syslog:arcsight_receiver]
server=xxxxxxx:514, xxxxxxx:514

Data is being forwarded to the first target, but not the second.

Any ideas?

Thanks!

0 Karma

SarahSplunk123
Explorer
0 Karma

SarahSplunk123
Explorer

Hello,

We tried it and had a peculiar behavior :
1st attempt : all sourcetypes were forwarded but db data sourcetype
2nd attempt none were forwarded to the second output, yet all were forwarded to the 1st one.

Do you have any idea why?
Any other solutions?

Best regards

0 Karma

dmaislin_splunk
Splunk Employee
Splunk Employee

I have not tested this, but could something like this work?

props.conf:

[sourcetype_or_source_of_your_choosing]
TRANSFORMS-my_syslog_group = send_to_server1,send_to_server2

transforms.conf:

[send_to_server1]
DEST_KEY = _SYSLOG_ROUTING
FORMAT = my_syslog_group1

[send_to_server2]
DEST_KEY = _SYSLOG_ROUTING
FORMAT = my_syslog_group2

outputs.conf:

[syslog:my_syslog_group1]
server = myhostname1:514
type = tcp

[syslog:my_syslog_group2]
server = myhostname2:514
type = tcp
0 Karma

ebailey
Communicator

Thanks for your help. Looks like I am out of luck.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Specifying multiple target groups clones the data instead.

0 Karma

ebailey
Communicator

Thanks - the syntax seemed to imply it would work but I guess not. I saw the format with multiple target groups as the capability I needed.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Okay - I think the syslog output doesn't support that. You've used the LB syntax that works with tcpout outputs for Splunk receivers, but http://docs.splunk.com/Documentation/Splunk/6.0.2/Admin/outputsconf doesn't mention that ability:

[syslog]
defaultGroup = <target_group>, <target_group>, ...

[syslog:<target_group>]
server = [<ip>|<servername>]:<port>

That doesn't include optional comma-separated LB alternatives 😞

ebailey
Communicator

load balancing - we need to scale across multiple connectors

Thanks!

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Are you looking for cloning or load balancing?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...