Getting Data In

forward Splunk logs to syslog server

pil321
Communicator

I have an unusual requirement from my client. To satisfy log retention policies (among other things) I need to send Splunk logs (from the indexer) to a syslog server (RHEL - rsyslog). I have seen many guides on how to send rsyslog files to Splunk, but haven't found anything so far on how to forward logs from Splunk to syslog. I'm only looking to send certain logs, which makes this ideal since Splunk will index what I need to send. I know that this is possible, just need to see an example.

Tags (2)
0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust
0 Karma

pil321
Communicator

Great! Thanks for the help - again!

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

A heavy forwarder and an indexer are based on the same set of features, so anything one can do can be done by the other as well.

Take a look at the IndexAndForward section in here http://docs.splunk.com/Documentation/Splunk/6.0.1/Admin/Outputsconf along with the Syslog section.

I don't have a fully functioning example to post, so far retention within Splunk was sufficient for everyone.

0 Karma

pil321
Communicator

The example shows how to do this from a heavy forwarder. Do you know if it would be possible from an indexer?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...