Indexer not filtering forwarded events

[keenerms]

So. We have recently changed MSSPs, and we are going to be forwarding events to them from our Splunk instance. We have a number of technologies going into Splunk, including IIS, Windows logs, and various security tools. The MSSP wants each technology on a different port. So we were going to split them using props.conf, transforms.conf, and outputs.conf as documented here: http://docs.splunk.com/Documentation/Splunk/6.2.5/Forwarding/Forwarddatatothird-partysystemsd

We are doing a test run, attempting to split out IIS logs to a test server to make sure we know how to do this... but it doesn't split out IIS logs, it appears to just send all logs to our test syslog listener. Appreciate other eyes on this to tell me how I'm screwing this up. The goal is to have only iis logs sent to our internal syslog server.

props.conf

[iis]
TRANSFORMS-iis=IISSampleTransform

transforms.conf

[IISSampleTransform]
REGEX = .
DEST_KEY = _SYSLOG_ROUTING
FORMAT = IISSample

outputs.conf

[syslog]
defaultGroup = UnknownMSS, IISSample

[syslog:IISSample]
server = 192.168.xxx.xxx:514
type = udp
priority = <18>

I read that the default group sent everything, so I tried removing the IISSample group from that line, but then it didn't send anything to the local (192.168.xxx.xxx) server. No logs period. When I add it to the default group I get all logs including Windows Event logs, syslog from the indexer, and the IIS logs. The filtering for IIS logs is not working at all. Appreciate any assistance. The "UnknownMSS" group is for another set of Stanzas that the MSSP directed us to add, but I didn't want to clog the question up with possibly unrelated info.

[bmacias84 · Accepted solution]

Are you trying to do this from the indexer? If so I don't think you can as routing to a third-party system from an indexer, because Splunk will only forward raw events to third-party. I believe that the events send to the indexer have already been cooked. I've only every done this for a Heavy Forwarder on the host sending the data.

Sending to a third-party

[keenerms]

Yep, it looks like that link and the original one I cited both specifically call out forwarders. We were trying this on an indexer since the indexer was on the correct subnet to make the changes without messing with firewall rules. Interesting. Thanks!

M.