Getting Data In

How to configure a heavy forwarder to route some of the data to syslogNG+Nullqueue?

DynaJimLin
Engager

I am trying to configure a heavy forwarder to route all of data to SyslogNG while route some data to null queue.

I need my data flow as below:

For Data Archive: HF -> all of data -> SyslogNG
For Daily Search: HF -> NullQueue -> Indexer

My issue is, when logs go to nullqueue, they do not go to syslogNG at all.
Is there any way to send to syslog while not indexing?

Also, I can not use these in inputs.conf:

SYSLOG_ROUTING = primarySyslogs
_TCP_ROUTING = somethingThatDoesntExistInOutputsConf

The reason is I use checkpoint lea app to get data, this app do not need to config regular inputs.conf.

Here is what I configured in props.conf, transforms.conf:

props.conf
[opsec]
TRANSFORMS-route = RouteToNG, RouteToNullQueue

transforms.conf
[RouteToNG]
REGEX = .
DEST_KEY = _SYSLOG_ROUTING
FORMAT = syslogNG

[RouteToNullQueue]
REGEX = action=accept
DEST_KEY = queue
FORMAT = nullQueue

outputs.conf
[tcpout]
defaultGroup = default-autolb-group

[tcpout-server://indexer:9997]

[tcpout:default-autolb-group]
disabled = false
server = indexer:9997

[syslog:syslogNG]
server = x.x.x.x:514

Labels (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi DynaJimLin,
I know that this isn't a direct solution to your problem but a workaround: did you explored the choice to send all data to SyslogNG and Indexer and then, on Indexer, filter them?
Bye.
Giuseppe

View solution in original post

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi DynaJimLin,
I know that this isn't a direct solution to your problem but a workaround: did you explored the choice to send all data to SyslogNG and Indexer and then, on Indexer, filter them?
Bye.
Giuseppe

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @DynaJimLin ,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉

0 Karma

richgalloway
SplunkTrust
SplunkTrust

I'm curious as to why you have your HF in front of syslog-ng. The more common configuration is to write to syslog first (letting it filter as it needs to) and let a forwarder to pick up the events from there.
It is not possible to route events anywhere after nullQueue. nullQueue is a dead end - any events sent there are discarded.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...