Hello guys,
today i was able to send some syslogs to another non-Splunk instance, however when i tried to send 1 type of sourcetype i failed hard.
These are my outputs.conf, props.conf and transforms.conf and i really have no idea why isn't working. Maybe it's something really simple but i can't figure out what is it.
outputs.conf
[syslog]
defaultGroup = syslogGroup
[syslog:syslogGroup]
server = dest ip:5146
props.conf
[sourcetype::WinEventLog:Security]
TRANSFORMS-mcafee = send_to_syslog
transforms.conf
[send_to_syslog]
REGEX = .
DEST_KEY = _SYSLOG_ROUTING
FORMAT = syslogGroup
Any kind of help would be appreciate.
You specify sourcetype without any prefix in props.conf (prefix only needed for source and host), so update your props.conf entry with this
props.conf
[WinEventLog:Security]
TRANSFORMS-mcafee = send_to_syslog
i made a mistake, it was supose to be WinEventLog:Security instead of fgt_traffic
How to verify that it is actually working?
Thanks for your answer, i made this modification and the problem persists. I tried to use " syslogSourceType = sourcetype::fgt_traffic" at output.conf but it didnt work either.