Page Comparison

...

1. Navigate to the Splunk installation root folder: %Splunk_Installation_Path%\etc\system\local\outputs.conf. All the configuration changes must to be performed on the file in the local folder.

2. Edit the outputs.conf file and do one of the configuration steps: [ If you do not have existing syslog configuration, add the following configuration under syslog. ]

   Code Block

   [syslog] defaultGroup = AccentureMxDR [syslog:AccentureMxDR] server = CyberHub_IP_Address:Port_Number type = tcp maxEventSize = 16384 sendCookedData = false priority = NO_PRI syslogSourceType = XmlWinEventLog ==================================== ------- Notes ----------- ==================================== Server: Add CyberHub IP address and Port number Type: Default is udp for Splunk, but MDR recommends TCP. MaxEventSize: MDR recommended value. All events exceeding this size will be truncated.

3. Edit the props.conf file and add the below routing attribute at the bottom.

   Code Block
   [source::WinEventLog:*] TRANSFORMS-WinEventLog=AccentureMxDRStanza - This can be any name.

4. Save and close the file.

5. Navigate to the Splunk installation root folder %Splunk_Installation_Path%\etc\system\local\transforms.conf. All the configuration changes must be performed on the file in the local folder.

6. Edit the transforms.conf file and add the below stanza at the bottom.

7. Edit $SPLUNK_HOME/etc/system/local/transforms.conf and set rules to match your props.conf stanza (i.e. AccentureMxDRStanza):

   Code Block
   [AccentureMxDRStanza] # This is stanza name which is defined in props.conf. REGEX=. DEST_KEY=_TCP_ROUTING FORMAT=AccentureMxDR #This is group name which defined in outputs.conf file

8. Restart the Splunk service.

...