Getting Data In

Splunk Logging or forwarding its Raw Messages

rferrante
New Member

For demo purposes, I plan to set up a single box (all-in-one) instance of Splunk and would like to configure Splunk such that all inputs that splunk ingests are stored in a local log file.

Is there an option in Splunk to log all of its raw input?
Or to forward it to another host:port?

Or if not, what would be the most straightforward programmatic direction for this?

Thanks!

Tags (2)
0 Karma

sdaniels
Splunk Employee
Splunk Employee

The easiest way to preserve your syslog would be to send the data to a syslog server first (like rsyslog, syslog-ng) and then have a Splunk forwarder monitor those files. However, you can forward data from Splunk to another host.

http://docs.splunk.com/Documentation/Splunk/5.0.4/Deploy/Forwarddatatothird-partysystemsd

You could use our SDKs to pull the data out of Splunk as well.

dev.splunk.com

0 Karma

rferrante
New Member

thank-you!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...