Scenario:
Project Splunk Deployment:
Corporate Splunk Deployment:
I currently have the project’s 5 DC’s sending their logs to a separate index on the project’s indexer, no problems.
I am also working with an intermediate forwarder for the project’s DC’s that forwards to both the project and another indexer (stand-in for corporate Splunk instance). Test clients are working via the intermediate, but not to different indexes.
Is it possible to send the DC’s security logs to an alternate index on the project’s indexer and the main index on corporate’s indexers? If so how?
This should be possible with an application of props and transforms -- assuming Light and/or Universal forwarder. Here's what I'd (roughly) do. (It may not be 100% correct, but it should be close)
On the forwarders - do not specify any particular index for the security logs. Use outputs.conf to have the forwarder send data to both Splunk environments.
On the corporate deployment - do nothing, and let the security logs fall into the default index
On the project deployment - use props/transforms to override the index for the WinEventLog:Security
sourcetype.
(props.conf)
[WinEventLog:Security]
TRANSFORMS-dc_index = dc_index
(transforms.conf)
[dc_index]
SOURCE_KEY = MetaData:Host
REGEX = ^host::(domaincontroller1|blinky|inky|pinky|clyde).company.com$
DEST_KEY = _MetaData:Index
FORMAT = high_security_index_name
rgcox1,
Obviously this isn't as easy as adding an index to specific stanzas in outputs.conf on a UF. How did you get it to work? Did you use props.conf and transforms.conf on the indexers or some clever configuration on the UF?
Finally getting back to this.
Your solution looks straight forward enough, but in the past I have had to make sure the alternate index exists on the forwarder -- even if not used (per Splunk support). Support has also told me this will not work on a universal forwarder, but I have gotten it to work.
So far I have not been able to get your solution to work using an intermediate forwarder (also recommended by Splunk tech).