Getting Data In

forward Splunk logs to syslog server

pil321
Communicator

I have an unusual requirement from my client. To satisfy log retention policies (among other things) I need to send Splunk logs (from the indexer) to a syslog server (RHEL - rsyslog). I have seen many guides on how to send rsyslog files to Splunk, but haven't found anything so far on how to forward logs from Splunk to syslog. I'm only looking to send certain logs, which makes this ideal since Splunk will index what I need to send. I know that this is possible, just need to see an example.

Tags (2)
0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust
0 Karma

pil321
Communicator

Great! Thanks for the help - again!

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

A heavy forwarder and an indexer are based on the same set of features, so anything one can do can be done by the other as well.

Take a look at the IndexAndForward section in here http://docs.splunk.com/Documentation/Splunk/6.0.1/Admin/Outputsconf along with the Syslog section.

I don't have a fully functioning example to post, so far retention within Splunk was sufficient for everyone.

0 Karma

pil321
Communicator

The example shows how to do this from a heavy forwarder. Do you know if it would be possible from an indexer?

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...