About Jag

Jag · ‎08-16-2010

Is this LightWeightForwarder(LWF) or a regular forwarder? If this is LightWeightForwarder, this may not work as data is not not parsed into individual events in LWF.

Jag · ‎06-24-2010

You can forward data to cloned targets, where targets can be either splunk instance or a device receiving TCP stream. In addition, you can also forward data to syslog target as well. The following configuration should enable cloning as well as forwarding via syslog. Set the following in outputs.conf: [tcpout] defaultGroup = group1, group2 # Clone data to group1 and group2 [tcpout:group1] server = indexer1:9997 [tcpout:group2] server = indexer2:9997 sendCookedData = false # Send raw TCP data(logs read by splunk) # Define syslog to send data to syslog target [syslog] defaultgroup = syslogGroup1 [syslog:syslogGroup1] server = syslogServer:514 # This prevents local indexing. To enable indexing, set index = true [indexAndForward] index = false

Jag · ‎01-29-2010

You can define following in outputs.conf to forward data in syslog format. [syslog] defaultGroup=myGroup [syslog:myGroup] server = syslogserver.mycompany.com:514 This will send events out in syslog format via UDP to port 514 on syslogserver.mycompany.com. You can set 'type=tcp' in [syslog:mygGroup] stanza to send data out via TCP. You can add priority header if missing in the source by setting 'priority' field. The value set in priority field will be emitted in the syslog header.

Jag · ‎01-22-2010

Used by deployment clients as well. This is is specified in deploymentclient.conf with attribute 'targetUri'.

Posts	4
Solutions	1
Karma Given	3
Karma Received	4
Member Since	‎01-22-2010

Online Status	Offline
Date Last Visited	‎06-05-2020 02:02 AM

Re: Filtering windows events not successful on spl...

Re: splunk forwarder

Re: Syslog Header In Output To A Syslog Server

Re: What uses the management port?