Getting Data In

splunk forwarder

heterodyned
Path Finder

I am planning to integrate Splunk data with MARS, would the cloning option work for Non-Splunk receiver as well? Or is it possible I could clone the data bein forwarded to its own Syslog, I can pull events from syslog accordingly....

1 Solution

Jag
Splunk Employee
Splunk Employee

You can forward data to cloned targets, where targets can be either splunk instance or a device receiving TCP stream. In addition, you can also forward data to syslog target as well.

The following configuration should enable cloning as well as forwarding via syslog. Set the following in outputs.conf:

[tcpout]
defaultGroup = group1, group2   # Clone data to group1 and group2

[tcpout:group1]
server = indexer1:9997

[tcpout:group2]
server = indexer2:9997
sendCookedData = false          # Send raw TCP data(logs read by splunk)

# Define syslog to send data to syslog target
[syslog]
defaultgroup = syslogGroup1

[syslog:syslogGroup1]
server = syslogServer:514

# This prevents local indexing. To enable indexing, set index = true
[indexAndForward]
index = false

View solution in original post

Jag
Splunk Employee
Splunk Employee

You can forward data to cloned targets, where targets can be either splunk instance or a device receiving TCP stream. In addition, you can also forward data to syslog target as well.

The following configuration should enable cloning as well as forwarding via syslog. Set the following in outputs.conf:

[tcpout]
defaultGroup = group1, group2   # Clone data to group1 and group2

[tcpout:group1]
server = indexer1:9997

[tcpout:group2]
server = indexer2:9997
sendCookedData = false          # Send raw TCP data(logs read by splunk)

# Define syslog to send data to syslog target
[syslog]
defaultgroup = syslogGroup1

[syslog:syslogGroup1]
server = syslogServer:514

# This prevents local indexing. To enable indexing, set index = true
[indexAndForward]
index = false

dskillman
Splunk Employee
Splunk Employee

I'm not sure you can use native Splunk forwarding to clone data to a MARS device. If MARS can accept the data via a TCP stream (rather than UDP) and you want to send all data to MARS than you will need to turn off 'cooked data'. (by default, The forwarder mechanism expects a Splunk server on the other end). Either way I think what you are looking for can be found at:

http://www.splunk.com/base/Documentation/4.1.2/Admin/Forwarddatatothird-partysystems

heterodyned
Path Finder

I was trying to forward syslog events collectively from Splunk Forwarder to Cisco MARS, MARS requires individually configuring all the linux boxes to MARS, where as splunk is already configured to receive these syslog messages, I was jus trying to route that data to MARS ....I guess I shouldnt be doing it there is a basic compatibitility issue between these two application/device

0 Karma

dskillman
Splunk Employee
Splunk Employee

Not sure what you're trying to accomplish. What is the SplunkForwarder collecting? Is it getting data sent to it? Or are you tailing files? What data do you want sent to MARS?

0 Karma

heterodyned
Path Finder

Is it possible otherwise, if the splunkforwarder can send syslog events to itself?? I wasnt able to configure MARS to accept tcp/udp connections on the fly with splunkforwarder....

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...