Getting Data In

Send one source to multiple outputs

audunn
New Member

I need to send off some of our data to a 3rd party tool as syslog data for automation purposes. I also don't want to lose these logs from being ingested into my splunk instance. Below is the config which will send my data via syslog from my heavy forwarder. My question is what do i need to add in order for this data to also be sent to my indexers for processing?

`#props.conf#
[host::abc]
TRANSFORMS-abc = send_to_third_party

transforms.conf

[send_to_third_party]
REGEX = .
DEST_KEY = _SYSLOG_ROUTING
FORMAT = send_to_third_party

outputs.conf

[send_to_third_party]
server = server.company.com:514`

0 Karma
1 Solution

kmorris_splunk
Splunk Employee
Splunk Employee

Take a look at this section from the docs:

Filter and route event data to target groups
https://docs.splunk.com/Documentation/Splunk/7.3.1/Forwarding/Routeandfilterdatad

It looks like you are missing tcpout in front of the group name in outputs.conf. See the example below from the doc:

Edit $SPLUNK_HOME/etc/system/local/outputs.conf to define the target groups.

[tcpout]
defaultGroup=everythingElseGroup

[tcpout:syslogGroup]
server=10.1.1.197:9996, 10.1.1.198:9997

[tcpout:errorGroup]
server=10.1.1.200:9999

[tcpout:everythingElseGroup]
server=10.1.1.250:6666

View solution in original post

daniel333
Builder

Nothing wrong wrong with using "host" but I know you're admin and he avoids it and sticks to source-type in his props.conf where possible 🙂

But looks like you have it, just don't forget sendCookedData=false and you're set. In your environment the Syslog server is also a heavy forwarder (no a desired architecture) so you just place that config there.

0 Karma

kmorris_splunk
Splunk Employee
Splunk Employee

Take a look at this section from the docs:

Filter and route event data to target groups
https://docs.splunk.com/Documentation/Splunk/7.3.1/Forwarding/Routeandfilterdatad

It looks like you are missing tcpout in front of the group name in outputs.conf. See the example below from the doc:

Edit $SPLUNK_HOME/etc/system/local/outputs.conf to define the target groups.

[tcpout]
defaultGroup=everythingElseGroup

[tcpout:syslogGroup]
server=10.1.1.197:9996, 10.1.1.198:9997

[tcpout:errorGroup]
server=10.1.1.200:9999

[tcpout:everythingElseGroup]
server=10.1.1.250:6666

audunn
New Member

YES that's the doc i was searching for for HOURS!

0 Karma

audunn
New Member

One follow up to this. If i want to send the syslog traffic over UDP how do i force that? don't see it in the docs (if even possible)

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...