Forward log to two Splunk indexers - different indexes on each.

[rgcox1]

Scenario:

Project Splunk Deployment:

• 1 indexer with ~250 Windows forwarders, a few Linux, and various other switches and hardware.
• Security logs from the project’s 5 domain controllers are considered sensitive, and must go to a separate index on the project indexer so that Splunk apps can be shared with non-IT users.
• ADDITIONAL INFO: All other security logs should go to the main index.

Corporate Splunk Deployment:

• 4 indexers with ~100 Windows domain controllers (including 5 from this project) forwarding security logs only, and various other routers, switches and hardware.
• Domain controller security logs go to main index.
• ADDITIONAL INFO: Corporate wants ONLY the security logs.
• ADDITIONAL INFO: The project has no access to the corporate Splunk instance, but if we want to get the logs from the DC's, we have to provide the solution to get the logs to the corporate instance.

I currently have the project’s 5 DC’s sending their logs to a separate index on the project’s indexer, no problems.

I am also working with an intermediate forwarder for the project’s DC’s that forwards to both the project and another indexer (stand-in for corporate Splunk instance). Test clients are working via the intermediate, but not to different indexes.

Is it possible to send the DC’s security logs to an alternate index on the project’s indexer and the main index on corporate’s indexers? If so how?

[dwaddle]

This should be possible with an application of props and transforms -- assuming Light and/or Universal forwarder. Here's what I'd (roughly) do. (It may not be 100% correct, but it should be close)

On the forwarders - do not specify any particular index for the security logs. Use outputs.conf to have the forwarder send data to both Splunk environments.

On the corporate deployment - do nothing, and let the security logs fall into the default index

On the project deployment - use props/transforms to override the index for the WinEventLog:Security sourcetype.

(props.conf)

[WinEventLog:Security]
TRANSFORMS-dc_index = dc_index

(transforms.conf)

[dc_index]
SOURCE_KEY = MetaData:Host
REGEX = ^host::(domaincontroller1|blinky|inky|pinky|clyde).company.com$
DEST_KEY = _MetaData:Index
FORMAT = high_security_index_name

[I_am_Jeff]

rgcox1,
Obviously this isn't as easy as adding an index to specific stanzas in outputs.conf on a UF. How did you get it to work? Did you use props.conf and transforms.conf on the indexers or some clever configuration on the UF?

[rgcox1]

Finally getting back to this.
Your solution looks straight forward enough, but in the past I have had to make sure the alternate index exists on the forwarder -- even if not used (per Splunk support). Support has also told me this will not work on a universal forwarder, but I have gotten it to work.
So far I have not been able to get your solution to work using an intermediate forwarder (also recommended by Splunk tech).