Getting Data In

Can Splunk write the data it receives to raw syslog files?

Glenn
Builder

Hi,

I know, this sounds backwards. However, this is a requirement for a migration process from a syslog-ng/custom java report builder based system to Splunk. The first step is forwarding the logs to their current report builder using Splunk if possible, the following step will be to replicate their reports in Splunk itself.

Basically I have lightforwarders consuming the application logs already, and would like to use these to forward the data to their reporting server to, hopefully a heavy forwarder, to write log files to the filesystem in raw standard syslog format. Their reports should be able to read these as if nothing has changed.

Is this possible?

Cheers,

Glenn

0 Karma
1 Solution

dwaddle
SplunkTrust
SplunkTrust

Splunk can't directly write to raw logfiles. But you can forward to a syslog-ng to do the writing for you. http://www.splunk.com/base/Documentation/latest/Deploy/Forwarddatatothird-partysystemsd

View solution in original post

dwaddle
SplunkTrust
SplunkTrust

Splunk can't directly write to raw logfiles. But you can forward to a syslog-ng to do the writing for you. http://www.splunk.com/base/Documentation/latest/Deploy/Forwarddatatothird-partysystemsd

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...