Set up routing

Set up routing

Enable routing to forward data from one Splunk server to another based on content. For example, data may be routed to systems based on sourcetype, a custom indexed field, or the content of the raw event. Routing allows you to specifically distribute events to any system.

First, decide which events to route to which servers. Then edit the props.conf, transforms.conf and outputs.conf files on the forwarding servers.

Configuration

props.conf

Edit $SPLUNK_HOME/etc/bundles/local/props.conf and set a TRANSFORMS-routing= attribute:

[<spec>]
TRANSFORMS-routing=$UNIQUE_STANZA_NAME

<spec> can be:

• <sourcetype>, the sourcetype of an event
• host::<host>, where <host> is the host for an event
• source::<source>, where <source> is the source for an event

$UNIQUE_STANZA_NAME should match the name of your stanza in transforms.conf.

transforms.conf

Edit $SPLUNK_HOME/etc/bundles/local/transforms.conf and set rules to match your props.conf stanza:

[$UNIQUE_STANZA_NAME]
REGEX=$YOUR_REGEX
DEST_KEY=_TCP_ROUTING
FORMAT=$UNIQUE_GROUP_NAME

• $UNIQUE_STANZA_NAME must match the name you created in transforms.conf.
• Enter the regex rules in $YOUR_REGEX to determine which events get conditionally routed.
• DEST_KEY should be set to _TCP_ROUTING to send events via TCP
• Set FORMAT to $UNIQUE_GROUP_NAME. This should match the group name you create in outputs.conf

outputs.conf

Edit $SPLUNK_HOME/etc/bundles/local/outputs.conf and set which tcpout outputs go to which servers or groups:

[tcpout:$UNIQUE_GROUP_NAME]
server=$IP:$PORT

• Set $UNIQUE_GROUP_NAME to match the name you created in props.conf.
• Set the IP address and port to match the receiving server.

Examples

Basic example

The following example sends all events with sourcetype="syslog" to one target group, all events that contain the word error to another target group, and everything else to a third target group.

props.conf

Edit $SPLUNK_HOME/etc/bundles/local/props.conf and set a TRANSFORMS-routing= attribute:

[default]
TRANSFORMS-routing=errorRouting
[syslog]
TRANSFORMS-routing=syslogRouting

transforms.conf

Edit $SPLUNK_HOME/etc/bundles/local/transforms.conf and set errorRouting and syslogRouting rules:

[errorRouting]
REGEX=error
DEST_KEY=_TCP_ROUTING
FORMAT=errorGroup
[syslogRouting]
REGEX=.
DEST_KEY=_TCP_ROUTING
FORMAT=syslogGroup

outputs.conf

Edit $SPLUNK_HOME/etc/bundles/local/outputs.conf and set which tcpout outputs go to with servers or groups:

[tcpout]
defaultGroup=everythingElseGroup
[tcpout:syslogGroup]
server=10.1.1.197:9997
[tcpout:errorGroup]
server=10.1.1.200:9999
[tcpout:everythingElseGroup]
server=10.1.1.250:6666

Complex example

This examples combines routing, data balancing and target group specific parameters. This outputs.conf sends all events with sourcetype="syslog" to one balanced target group, all events that contain the word error to a different target group, and clones everything else to two target groups. The syslogGroup uses a persistent queue which lives in the /tmp directory and is capped at a maximum on disk size of 100MB. The heartbeat frequency for all target groups is dialed down to 10 seconds.

Note: the props.conf and transforms.conf are the same as the example above.

outputs.conf

[tcpout]
defaultGroup=everythingElseGroup1, everthingElseGroup2
heartbeatFrequency=10
[tcpout:syslogGroup]
server=10.1.1.197:9997, 10.1.1.198:7777
usePersistentQueue=true
blockOnQueueFull=true
persistentQueuePath=/tmp
maxPersistentQueueSizeInMegs=100
[tcpout:errorGroup]
server=10.1.1.200:9999
[tcpout:everythingElseGroup1]
server=10.1.1.240:6666
[tcpout:everythingElseGroup2]
server=10.1.1.245:5555

• Was this topic useful?
• Post a comment